How to fix hsts disabled on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. In the Magento Admin, go to Stores → Configuration → General → Web → Base URLs (Secure) and ensure all base URLs use https://.
2. For the server-level HSTS header on Apache, add to your VirtualHost config or .htaccess: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" — then run apachectl configtest && sudo systemctl reload apache2.
3. For Nginx, add to your server {} block in /etc/nginx/sites-available/magento.conf (or equivalent): add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; — then reload nginx.
4. If you use Adobe Commerce Cloud (the cloud.magento.com / Fastly setup), add the header in .magento.app.yaml or configure it via the Fastly VCL snippet in Admin → Stores → Fastly Configuration → Custom VCL Snippets.
5. Flush the Magento and Varnish/full-page cache after changes: Admin → System → Cache Management → Flush Magento Cache.
6. Verify with: curl -I https://yourdomain.com | grep -i strict-transport

What is hsts disabled?

HTTP Strict-Transport-Security (HSTS) is a security header your web server sends to browsers. It tells the browser: "Never load this site over plain HTTP — always use HTTPS, no matter what." Once a browser sees this instruction, it enforces HTTPS automatically for the duration you specify (the max-age, measured in seconds). A max-age=0 effectively disables HSTS, meaning the browser forgets the rule immediately and offers no protection. The correct setting is max-age=31536000 (one year) with includeSubDomains so all parts of your site are covered.

Without a valid HSTS header, shoppers who type your domain into a browser or click a plain HTTP link are briefly exposed to a "downgrade attack" — a hacker on the same network (e.g., public Wi-Fi) can intercept that first unencrypted request and silently redirect them to a fake version of your store, stealing passwords, credit card numbers, or session cookies. This is classified under OWASP's A02:2021 Cryptographic Failures, one of the most exploited vulnerability categories in real-world breaches. Beyond security, Google has used HTTPS as a ranking signal since 2014, and browsers display "Not Secure" warnings that destroy shopper trust and conversion rates. Fixing HSTS is a free, low-effort change with immediate security and trust benefits.

See the complete Hsts disabled guide for every platform and the full background.