Hsts disabled

Quick win

Set a valid HTTP Strict-Transport-Security (HSTS) header with a max-age of at least 31536000 (one year) and includeSubDomains to force browsers to always use HTTPS for your store.

What it is

HTTP Strict-Transport-Security (HSTS) is a security header your web server sends to browsers. It tells the browser: "Never load this site over plain HTTP — always use HTTPS, no matter what." Once a browser sees this instruction, it enforces HTTPS automatically for the duration you specify (the max-age, measured in seconds). A max-age=0 effectively disables HSTS, meaning the browser forgets the rule immediately and offers no protection. The correct setting is max-age=31536000 (one year) with includeSubDomains so all parts of your site are covered.

Why it matters

Without a valid HSTS header, shoppers who type your domain into a browser or click a plain HTTP link are briefly exposed to a "downgrade attack" — a hacker on the same network (e.g., public Wi-Fi) can intercept that first unencrypted request and silently redirect them to a fake version of your store, stealing passwords, credit card numbers, or session cookies. This is classified under OWASP's A02:2021 Cryptographic Failures, one of the most exploited vulnerability categories in real-world breaches. Beyond security, Google has used HTTPS as a ranking signal since 2014, and browsers display "Not Secure" warnings that destroy shopper trust and conversion rates. Fixing HSTS is a free, low-effort change with immediate security and trust benefits.

How to fix it

  1. Confirm your store is fully served over HTTPS and that your SSL/TLS certificate is valid and auto-renewing — HSTS should never be enabled on a site that still has HTTP-only pages.
  2. Identify where HTTP response headers are set for your store: your hosting control panel, CDN/proxy (e.g., Cloudflare), web server config file (nginx or Apache), or your platform's admin.
  3. Add or update the Strict-Transport-Security header to: Strict-Transport-Security: max-age=31536000; includeSubDomains
  4. Optionally append ; preload to the header value and submit your domain at hstspreload.org to be hard-coded into browsers — this is the strongest protection but is irreversible without a long wait, so only do it when you are certain all subdomains will remain on HTTPS.
  5. Deploy the change and verify it using your browser's DevTools (Network tab → click your domain → Response Headers) or a free online HSTS checker — confirm max-age is 31536000 and there is no max-age=0.
  6. Monitor your SSL certificate expiry dates; an expired certificate on an HSTS-enabled site will hard-block visitors and cannot be bypassed by clicking through a warning.

Fix it on your platform

Pick your platform for the exact steps.

How to fix hsts disabled on Shopify
  1. Shopify automatically enforces HTTPS and sets HSTS for all stores on the shopify.com infrastructure — you cannot and do not need to set it manually in the Shopify admin.
  2. If you use a custom domain, go to Admin → Settings → Domains and ensure your domain shows a green 'Connected and redirecting to HTTPS' status; Shopify then manages the HSTS header for you.
  3. If your store sits behind a custom reverse proxy or a third-party CDN (e.g., Cloudflare in front of Shopify), set the HSTS header in that proxy layer — see the Cloudflare steps below.
  4. Verify the live header at your domain using browser DevTools (F12 → Network → your domain request → Response Headers) and confirm Strict-Transport-Security is present with max-age=31536000.
Full Shopify guide →Official Shopify docs ↗
How to fix hsts disabled on Shopify Plus
  1. Shopify Plus manages HSTS at the platform level for storefronts hosted on Shopify infrastructure — no manual header configuration is required or available in the admin.
  2. For headless/custom storefronts or any reverse-proxy layer you control in front of Shopify Plus, add the Strict-Transport-Security header in your proxy/CDN configuration (e.g., Cloudflare, Fastly, or your own nginx/Node server).
  3. In Cloudflare: Log in → select your domain → Security → Settings → enable HTTP Strict Transport Security (HSTS) → set Max Age to 12 months, tick includeSubDomains.
  4. Verify with DevTools: F12 → Network → reload page → click the document request → Response Headers → look for Strict-Transport-Security: max-age=31536000; includeSubDomains.
Full Shopify Plus guide →Official Shopify Plus docs ↗
How to fix hsts disabled on WooCommerce
  1. WooCommerce runs on WordPress, so HSTS must be set at the web server or hosting level, not inside the WordPress admin.
  2. For Apache hosting: open or create a .htaccess file in your site root (via File Manager in cPanel or via FTP) and add inside the <IfModule mod_headers.c> block: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  3. For Nginx hosting: open your server block config (e.g., /etc/nginx/sites-available/yoursite.conf) and add inside the server {} block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; — then run nginx -t and sudo systemctl reload nginx.
  4. Alternatively, install the free 'Headers and Footers by WPBeginner' plugin or 'WP Headers and Footers' — however, note that PHP-level headers must be set before any output; using a caching plugin or server-level config is more reliable.
  5. If you use a managed WordPress host (WP Engine, Kinsta, Flywheel), open a support ticket or use their dashboard's 'Security Headers' section — many set HSTS for you automatically.
  6. Verify with DevTools or curl: curl -I https://yourdomain.com | grep -i strict
Full WooCommerce guide →Official WooCommerce docs ↗
How to fix hsts disabled on BigCommerce
  1. BigCommerce manages HSTS at the platform infrastructure level for all storefronts — the header is set automatically and you cannot configure it manually from the admin.
  2. If your BigCommerce store is fronted by Cloudflare or another CDN/proxy that you control, ensure that proxy is not stripping or overriding the HSTS header.
  3. To check: go to your storefront URL in a browser, open DevTools (F12) → Network tab → click the top-level document request → Response Headers, and confirm Strict-Transport-Security is present.
  4. For headless BigCommerce setups (Next.js, Nuxt, custom front-end), set the HSTS header in your front-end server or CDN configuration — see the Headless/Custom entry below.
Full BigCommerce guide →Official BigCommerce docs ↗
How to fix hsts disabled on Adobe Commerce (Magento)
  1. In the Magento Admin, go to Stores → Configuration → General → Web → Base URLs (Secure) and ensure all base URLs use https://.
  2. For the server-level HSTS header on Apache, add to your VirtualHost config or .htaccess: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" — then run apachectl configtest && sudo systemctl reload apache2.
  3. For Nginx, add to your server {} block in /etc/nginx/sites-available/magento.conf (or equivalent): add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; — then reload nginx.
  4. If you use Adobe Commerce Cloud (the cloud.magento.com / Fastly setup), add the header in .magento.app.yaml or configure it via the Fastly VCL snippet in Admin → Stores → Fastly Configuration → Custom VCL Snippets.
  5. Flush the Magento and Varnish/full-page cache after changes: Admin → System → Cache Management → Flush Magento Cache.
  6. Verify with: curl -I https://yourdomain.com | grep -i strict-transport
Full Adobe Commerce (Magento) guide →Official Adobe Commerce (Magento) docs ↗
How to fix hsts disabled on Magento Open Source
  1. Set the HSTS header at the Apache or Nginx web server level — the steps are identical to Adobe Commerce (Magento) above.
  2. For Apache .htaccess in your Magento root, add inside <IfModule mod_headers.c>: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  3. For Nginx server block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  4. Reload your web server and flush full-page cache: php bin/magento cache:flush
  5. Verify: curl -I https://yourdomain.com | grep -i strict
Full Magento Open Source guide →Official Magento Open Source docs ↗
How to fix hsts disabled on Wix
  1. Wix automatically serves all sites over HTTPS and manages the HSTS header at the platform level — you cannot manually configure HTTP response headers from the Wix editor or dashboard.
  2. Ensure 'Force HTTPS' is enabled: in the Wix dashboard go to Settings → SSL/TLS Certificate → confirm the toggle for 'Force HTTPS redirects' is ON.
  3. If you need custom security headers (e.g., for a Wix Velo / headless setup), you can set headers within Wix Velo (formerly Corvid) using the http-functions.js file — add a response header in your backend HTTP function.
  4. Verify the live header using DevTools or an online HSTS checker to confirm the platform is sending the header correctly.
Full Wix guide →Official Wix docs ↗
How to fix hsts disabled on Wix Studio
  1. Like standard Wix, Wix Studio manages HTTPS and HSTS at the infrastructure level — no manual header configuration is available in the Studio editor.
  2. Confirm HTTPS is forced: Site Settings → SSL → Force HTTPS should be enabled.
  3. For custom HTTP logic in Wix Studio, use the Velo backend (http-functions.js) to add headers to API/serverless responses if needed.
  4. Use DevTools to verify the Strict-Transport-Security header is present on your live domain.
Full Wix Studio guide →Official Wix Studio docs ↗
How to fix hsts disabled on Squarespace
  1. Squarespace automatically enables HTTPS and sets an HSTS header for all custom domains — there is no manual header configuration panel in the Squarespace admin.
  2. Ensure SSL is active: go to Settings → Domains → click your domain → confirm the SSL badge shows 'Active'.
  3. If your domain was recently connected, wait up to 72 hours for SSL provisioning and HSTS to propagate.
  4. Verify using DevTools (F12 → Network → your domain → Response Headers) that Strict-Transport-Security is present.
Full Squarespace guide →Official Squarespace docs ↗
How to fix hsts disabled on Webflow
  1. Webflow sets HSTS automatically for sites hosted on Webflow's infrastructure (webflow.io or custom domains with Webflow hosting) — no manual configuration is needed.
  2. Ensure your custom domain is published and SSL is active: go to Site Settings → Publishing → Custom Domain → confirm the green SSL lock icon.
  3. If you export Webflow code and self-host it, you must set the HSTS header in your own web server (Apache/Nginx) or CDN — follow the generic server steps above.
  4. Verify with DevTools on your live Webflow-hosted URL.
Full Webflow guide →Official Webflow docs ↗
How to fix hsts disabled on Headless / Custom (I build in code)
  1. For Node.js/Express, use the helmet middleware: npm install helmet, then app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true }));
  2. For Next.js, add the header in next.config.js inside the headers() async function (see code snippet below).
  3. For Nginx, add to your server {} block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; — then nginx -t && nginx -s reload.
  4. For Apache, add to VirtualHost or .htaccess: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  5. For Cloudflare (as CDN in front of any stack): Dashboard → your domain → Security → Settings → HTTP Strict Transport Security → Enable, Max Age = 12 months, includeSubDomains = ON.
  6. Verify with: curl -I https://yourdomain.com | grep -i strict-transport-security
Full Headless / Custom (I build in code) guide →Official Headless / Custom (I build in code) docs ↗
How to fix hsts disabled on PrestaShop
  1. In PrestaShop Admin, go to Shop Parameters → General → Enable SSL on all pages → set to YES, and Enable SSL → YES.
  2. Then set the HSTS header at the server level: for Apache, edit .htaccess in your PrestaShop root and add inside <IfModule mod_headers.c>: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  3. For Nginx, add add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; to your server block and reload nginx.
  4. Verify: curl -I https://yourdomain.com | grep -i strict
Full PrestaShop guide →Official PrestaShop docs ↗
How to fix hsts disabled on OpenCart
  1. Set SSL URLs: Admin → Settings → Store → Server tab → set Use SSL to Yes, and enter your https:// URL in the SSL URL field.
  2. Set the HSTS header at the Apache or Nginx level — OpenCart itself does not provide a security headers UI.
  3. Apache (.htaccess in OpenCart root): add Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" inside <IfModule mod_headers.c>.
  4. Nginx server block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; then reload nginx.
  5. Verify with DevTools or curl.
Full OpenCart guide →Official OpenCart docs ↗
How to fix hsts disabled on WordPress.org
  1. Install a security headers plugin such as 'Headers Security Advanced & HSTS WP' or 'Solid Security (iThemes Security)' from WordPress Admin → Plugins → Add New.
  2. In the plugin's settings panel, find the HSTS or Security Headers section and enable Strict-Transport-Security with max-age set to 31536000 and 'Include Subdomains' enabled.
  3. Alternatively, add the header directly in your theme's functions.php (child theme recommended): `add_action('send_headers', function(){ header('Strict-Transport-Security: max-age=31536000; includeSubDomains'); });`
  4. For server-level control, edit your Nginx or Apache config as described in the WooCommerce steps above — this is the most reliable method.
Full WordPress.org guide →Official WordPress.org docs ↗

Does your site have this issue?

Run a free SEOLZ scan to find hsts disabled — and every other issue — across your whole site in minutes.

Scan my site free

Frequently asked questions

What is Hsts disabled?

HTTP Strict-Transport-Security (HSTS) is a security header your web server sends to browsers. It tells the browser: "Never load this site over plain HTTP — always use HTTPS, no matter what." Once a browser sees this instruction, it enforces HTTPS automatically for the duration you specify (the max-age, measured in seconds). A max-age=0 effectively disables HSTS, meaning the browser forgets the rule immediately and offers no protection. The correct setting is max-age=31536000 (one year) with includeSubDomains so all parts of your site are covered.

Why does hsts disabled matter?

Without a valid HSTS header, shoppers who type your domain into a browser or click a plain HTTP link are briefly exposed to a "downgrade attack" — a hacker on the same network (e.g., public Wi-Fi) can intercept that first unencrypted request and silently redirect them to a fake version of your store, stealing passwords, credit card numbers, or session cookies. This is classified under OWASP's A02:2021 Cryptographic Failures, one of the most exploited vulnerability categories in real-world breaches. Beyond security, Google has used HTTPS as a ranking signal since 2014, and browsers display "Not Secure" warnings that destroy shopper trust and conversion rates. Fixing HSTS is a free, low-effort change with immediate security and trust benefits.

How do I fix hsts disabled?

Set a valid HTTP Strict-Transport-Security (HSTS) header with a max-age of at least 31536000 (one year) and includeSubDomains to force browsers to always use HTTPS for your store.

Authoritative references

Related Security (OWASP) issues