How to fix hsts disabled on Wix

Steps for Wix

1. Wix automatically serves all sites over HTTPS and manages the HSTS header at the platform level — you cannot manually configure HTTP response headers from the Wix editor or dashboard.
2. Ensure 'Force HTTPS' is enabled: in the Wix dashboard go to Settings → SSL/TLS Certificate → confirm the toggle for 'Force HTTPS redirects' is ON.
3. If you need custom security headers (e.g., for a Wix Velo / headless setup), you can set headers within Wix Velo (formerly Corvid) using the http-functions.js file — add a response header in your backend HTTP function.
4. Verify the live header using DevTools or an online HSTS checker to confirm the platform is sending the header correctly.

What is hsts disabled?

HTTP Strict-Transport-Security (HSTS) is a security header your web server sends to browsers. It tells the browser: "Never load this site over plain HTTP — always use HTTPS, no matter what." Once a browser sees this instruction, it enforces HTTPS automatically for the duration you specify (the max-age, measured in seconds). A max-age=0 effectively disables HSTS, meaning the browser forgets the rule immediately and offers no protection. The correct setting is max-age=31536000 (one year) with includeSubDomains so all parts of your site are covered.

Without a valid HSTS header, shoppers who type your domain into a browser or click a plain HTTP link are briefly exposed to a "downgrade attack" — a hacker on the same network (e.g., public Wi-Fi) can intercept that first unencrypted request and silently redirect them to a fake version of your store, stealing passwords, credit card numbers, or session cookies. This is classified under OWASP's A02:2021 Cryptographic Failures, one of the most exploited vulnerability categories in real-world breaches. Beyond security, Google has used HTTPS as a ranking signal since 2014, and browsers display "Not Secure" warnings that destroy shopper trust and conversion rates. Fixing HSTS is a free, low-effort change with immediate security and trust benefits.

See the complete Hsts disabled guide for every platform and the full background.