Ask any question about Website Security here... and get an instant response.
Post this Question & Answer:
How can I enforce HTTPS for all traffic on my website?
Asked on Apr 30, 2026
Answer
To enforce HTTPS for all traffic on your website, you can use HTTP Strict Transport Security (HSTS). This security feature instructs browsers to only interact with your site using HTTPS, preventing any attempts to access it over HTTP.
<!-- BEGIN COPY / PASTE -->
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
<!-- END COPY / PASTE -->Additional Comment:
- The
max-agedirective specifies the duration (in seconds) that the browser should remember to only use HTTPS. - Use
includeSubDomainsto enforce HTTPS on all subdomains. - The
preloaddirective allows your domain to be included in browsers' HSTS preload lists, ensuring HTTPS is used from the first visit.
✅ Answered with Security best practices.
Recommended Links:
