Missing strict transport security

Quick win

Add the Strict-Transport-Security (HSTS) response header to every HTTPS page so browsers always use an encrypted connection to your store.

What it is

HTTP Strict Transport Security (HSTS) is a small instruction your web server sends inside every page response that tells browsers: "never load this site over plain HTTP — always use HTTPS, no exceptions." Without it, a browser will happily follow any link or redirect that starts with `http://`, even if your server immediately redirects to `https://`. That brief unencrypted moment is enough for an attacker on the same Wi-Fi network to intercept the request. The HSTS header closes that window entirely by making the browser refuse the insecure connection before it even leaves the device.

Why it matters

Security: Customers shopping on public Wi-Fi are vulnerable to SSL-stripping attacks — where a hacker silently downgrades their HTTPS session to plain HTTP and reads login cookies, payment info, or session tokens in the clear. HSTS prevents this. *SEO & Rankings:* Google uses HTTPS as a confirmed ranking signal and may deprioritize pages that can be reached over HTTP; a strong HSTS policy reinforces your site's "always-HTTPS" status. *Compliance & Legal:* PCI-DSS (required for any store that handles card payments) and GDPR both demand that customer data be encrypted in transit — a missing HSTS header is a finding auditors flag. *Conversions:* Browsers display security warnings for mixed-content or downgrade scenarios; even a brief warning causes visitors to abandon their cart.

How to fix it

  1. Confirm your store already has a valid, trusted SSL/TLS certificate installed and all pages are served over HTTPS — HSTS must never be deployed on a site without working HTTPS.
  2. Decide on the correct HSTS header value. Start with a short max-age (e.g. 300 seconds) to test, then increase to the recommended 31536000 (1 year). Only add includeSubDomains once you have verified every subdomain also serves valid HTTPS. Only add preload if you intend to submit to the HSTS preload list.
  3. Add the response header Strict-Transport-Security: max-age=31536000; includeSubDomains to every HTTPS response from your store. Never send this header on HTTP responses.
  4. Test by visiting your store with a browser DevTools Network panel open and confirming the response headers include Strict-Transport-Security with the correct value.
  5. Verify with a free tool such as securityheaders.com or hstspreload.org that the header is present, correctly formed, and not being overridden by a CDN or proxy layer.
  6. Once you have confirmed the header is stable, optionally add the preload directive and submit your domain to hstspreload.org for inclusion in browser preload lists — this gives even stronger protection for first-time visitors.

Fix it on your platform

Pick your platform for the exact steps.

How to fix missing strict transport security on Shopify
  1. Shopify's cloud infrastructure automatically enforces HTTPS for all storefronts on myshopify.com and custom domains added through the Shopify admin.
  2. Go to Admin → Settings → Domains. Ensure your custom domain shows a green padlock / 'SSL certificate available' status.
  3. Shopify injects the Strict-Transport-Security header server-side for all storefronts. If it is missing, the most common cause is a third-party proxy (Cloudflare, Fastly, etc.) stripping the header — fix it at the proxy level (see CDN note below).
  4. If you use Shopify Plus with custom server-side middleware (Oxygen / Hydrogen), add the header in your server response handler — see the Headless / Custom code snippet below.
Full Shopify guide →Official Shopify docs ↗
How to fix missing strict transport security on Shopify Plus
  1. For standard Shopify Plus storefronts, the platform manages HSTS automatically — verify the header is present using browser DevTools or securityheaders.com.
  2. For Hydrogen / Oxygen (headless) storefronts, open your server entry file (e.g. server.ts) and add the Strict-Transport-Security header to every response object before it is returned to the client — see the Node/Hydrogen snippet below.
  3. If you front your storefront with Cloudflare, enable 'HTTP Strict Transport Security (HSTS)' under SSL/TLS → Edge Certificates in your Cloudflare dashboard and set max-age to 31536000 with includeSubDomains enabled.
Full Shopify Plus guide →Official Shopify Plus docs ↗
How to fix missing strict transport security on WooCommerce
  1. Log in to your WordPress admin. The HSTS header is a server-level response header, not a WordPress setting, so you must set it in one of three places.
  2. Option A — via .htaccess (Apache servers): Open your root .htaccess file via FTP/SFTP or cPanel File Manager. Add the HSTS block from the Apache snippet below ABOVE the WordPress permalink block.
  3. Option B — via nginx.conf (Nginx servers): SSH into your server or use your host's control panel to edit your server block config. Add the add_header line from the Nginx snippet below inside your HTTPS server {} block, then reload nginx.
  4. Option C — via a WordPress plugin: Install the 'HTTP Headers' plugin (by David Gwyer) or 'Security Headers' plugin. Go to Settings → HTTP Headers (or Security Headers), find Strict-Transport-Security, enable it, set max-age to 31536000, and tick includeSubDomains.
  5. Verify with browser DevTools (Network tab → click any request → Response Headers) that the header appears on all pages including the homepage, shop, and checkout.
Full WooCommerce guide →Official WooCommerce docs ↗
How to fix missing strict transport security on BigCommerce
  1. BigCommerce cloud storefronts serve all pages over HTTPS and the platform manages core transport security.
  2. Check whether the HSTS header is already present by opening browser DevTools → Network tab → click the homepage request → Response Headers.
  3. If the header is missing, it is most likely being dropped by a CDN or reverse proxy in front of your store. Log in to your CDN dashboard (e.g., Cloudflare: SSL/TLS → Edge Certificates → HSTS) and enable HSTS with max-age=31536000 and includeSubDomains.
  4. For BigCommerce Enterprise with a custom server-side layer, add the header in your proxy/middleware configuration.
  5. Contact BigCommerce support if the header is absent and no CDN is in use — this may be a platform-level configuration they need to adjust for your account.
Full BigCommerce guide →Official BigCommerce docs ↗
How to fix missing strict transport security on Wix
  1. Wix manages HTTPS and HTTP-to-HTTPS redirection automatically for all sites on Wix infrastructure.
  2. HSTS headers are controlled by Wix's servers and are not configurable from the Wix dashboard by site owners.
  3. Verify the header is present using browser DevTools or securityheaders.com. Wix has progressively deployed HSTS across its platform; if it is missing, contact Wix Support and reference the Strict-Transport-Security header requirement.
  4. If your Wix site is behind Cloudflare (added via your domain registrar), log in to Cloudflare → SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS) and enable it with max-age=31536000.
Full Wix guide →Official Wix docs ↗
How to fix missing strict transport security on Wix Studio
  1. Wix Studio sites run on the same Wix infrastructure, so HSTS is managed server-side by Wix — it is not configurable from the Studio editor.
  2. Check for the header in browser DevTools → Network → Response Headers on your published site.
  3. If absent, contact Wix Support. Alternatively, if a Cloudflare proxy sits in front of your domain, configure HSTS in Cloudflare → SSL/TLS → Edge Certificates → HSTS section.
Full Wix Studio guide →Official Wix Studio docs ↗
How to fix missing strict transport security on Squarespace
  1. Squarespace automatically provisions SSL and enforces HTTPS for all sites — HSTS is intended to be managed at the platform level.
  2. Verify the header is present on your live domain with browser DevTools or securityheaders.com.
  3. If missing, contact Squarespace Support referencing the Strict-Transport-Security header. There is no in-dashboard toggle for HSTS.
  4. If your domain routes through Cloudflare, enable HSTS in Cloudflare → SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS).
Full Squarespace guide →Official Squarespace docs ↗
How to fix missing strict transport security on Webflow
  1. Webflow hosts sites on its own CDN with HTTPS enforced. The platform manages HSTS headers server-side.
  2. Go to your Webflow Project Settings → Hosting and confirm SSL is enabled for your custom domain.
  3. Publish your site and verify the Strict-Transport-Security header is present using browser DevTools → Network tab → select your homepage request → Response Headers.
  4. If the header is absent, contact Webflow Support. There is no dashboard toggle for HSTS in Webflow's current admin.
  5. If your domain is proxied through Cloudflare, enable HSTS in Cloudflare → SSL/TLS → Edge Certificates → HSTS section and set max-age=31536000 with includeSubDomains.
Full Webflow guide →Official Webflow docs ↗
How to fix missing strict transport security on Adobe Commerce (Magento)
  1. SSH into your server or open your hosting control panel.
  2. For Apache: Edit the VirtualHost block in your HTTPS (port 443) configuration file (e.g. /etc/apache2/sites-available/yourdomain.conf) and add: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains". Enable mod_headers if not already active: a2enmod headers && systemctl restart apache2.
  3. For Nginx: Edit your server block config and add: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; inside the server { listen 443 ssl; } block, then run: nginx -t && systemctl reload nginx.
  4. Alternatively, in Adobe Commerce Admin go to Stores → Configuration → General → Web → Base URLs (Secure) and ensure all URLs use https://. Then set Use Secure URLs on Storefront and Use Secure URLs in Admin both to Yes. This does not add the HSTS header itself but ensures no HTTP fallback occurs alongside your server-level header.
  5. Flush the Magento cache: Admin → System → Cache Management → Flush Magento Cache.
  6. Verify with browser DevTools that the header appears on the storefront, admin, and any subdomain used for static assets.
Full Adobe Commerce (Magento) guide →Official Adobe Commerce (Magento) docs ↗
How to fix missing strict transport security on Magento Open Source
  1. Follow the same Apache or Nginx server-level steps as Adobe Commerce (Magento) above — the process is identical for the open-source edition.
  2. Edit your HTTPS VirtualHost (Apache) or server block (Nginx) to add the Strict-Transport-Security header as shown in the code snippets below.
  3. Ensure mod_headers (Apache) or the ngx_http_headers_module (Nginx, compiled in by default) is active.
  4. Flush the Magento cache after any configuration change: php bin/magento cache:flush.
Full Magento Open Source guide →Official Magento Open Source docs ↗
How to fix missing strict transport security on PrestaShop
  1. Log in to your hosting control panel or SSH into your server.
  2. For Apache hosting: Edit the .htaccess file in your PrestaShop root directory OR your Apache VirtualHost config for the HTTPS site. Add the HSTS Header directive from the Apache snippet below.
  3. For Nginx hosting: Edit your Nginx server block for port 443 and add the add_header directive from the Nginx snippet below, then reload Nginx.
  4. Alternatively, use a PrestaShop security module (e.g., 'HTTP Headers Manager' from the Addons Marketplace) that lets you set security headers from the PrestaShop back office.
  5. Go to Admin → Shop Parameters → General and ensure 'Force SSL for all pages' (SSL enabled on all pages) is set to Yes before deploying HSTS.
  6. Verify the header is present in browser DevTools after saving.
Full PrestaShop guide →Official PrestaShop docs ↗
How to fix missing strict transport security on OpenCart
  1. OpenCart does not provide a built-in setting for HSTS headers — the header must be set at the server level.
  2. For Apache: Edit your .htaccess file in the OpenCart root or your VirtualHost config for the HTTPS site. Add the HSTS Header directive from the Apache snippet below.
  3. For Nginx: Add the add_header directive from the Nginx snippet below to your HTTPS server block, then reload Nginx.
  4. Confirm in your OpenCart Admin → Settings → Server that 'Use SSL' is set to Yes for the entire store, not just checkout.
  5. Verify with browser DevTools.
Full OpenCart guide →Official OpenCart docs ↗
How to fix missing strict transport security on Headless / Custom (I build in code)
  1. Add the Strict-Transport-Security response header inside your server or middleware layer — see the code snippets below for Node.js (Express), Next.js, and generic server config formats.
  2. For Next.js: Add the header in next.config.js under the headers() async function.
  3. For Express.js: Use the helmet npm package (helmet() includes HSTS by default) or set the header manually with res.setHeader().
  4. For any reverse proxy (Nginx, Apache, Caddy) in front of your application: add the header at the proxy level so it applies to every response regardless of the backend.
  5. Set max-age=31536000 (one year) and includeSubDomains. Test with browser DevTools before enabling preload.
  6. After deploying, verify with securityheaders.com or hstspreload.org.
Full Headless / Custom (I build in code) guide →Official Headless / Custom (I build in code) docs ↗
How to fix missing strict transport security on WordPress.org
  1. WordPress.org (self-hosted) — set HSTS at the server or plugin level, not in WordPress PHP.
  2. Recommended plugin: Install 'HTTP Headers' by WebFactory from the WordPress plugin directory. Admin → HTTP Headers → Security Headers → Strict-Transport-Security → Enable → set max-age=31536000, check includeSubDomains → Save.
  3. Server-level (Apache): Add `Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"` inside a `<IfModule mod_headers.c>` block in .htaccess.
  4. Server-level (Nginx): Add `add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;` in the SSL server block.
  5. Verify in DevTools → Network → document response headers.
Full WordPress.org guide →Official WordPress.org docs ↗

Does your site have this issue?

Run a free SEOLZ scan to find missing strict transport security — and every other issue — across your whole site in minutes.

Scan my site free

Frequently asked questions

What is Missing strict transport security?

HTTP Strict Transport Security (HSTS) is a small instruction your web server sends inside every page response that tells browsers: "never load this site over plain HTTP — always use HTTPS, no exceptions." Without it, a browser will happily follow any link or redirect that starts with `http://`, even if your server immediately redirects to `https://`. That brief unencrypted moment is enough for an attacker on the same Wi-Fi network to intercept the request. The HSTS header closes that window entirely by making the browser refuse the insecure connection before it even leaves the device.

Why does missing strict transport security matter?

**Security:** Customers shopping on public Wi-Fi are vulnerable to SSL-stripping attacks — where a hacker silently downgrades their HTTPS session to plain HTTP and reads login cookies, payment info, or session tokens in the clear. HSTS prevents this. **SEO & Rankings:** Google uses HTTPS as a confirmed ranking signal and may deprioritize pages that can be reached over HTTP; a strong HSTS policy reinforces your site's "always-HTTPS" status. **Compliance & Legal:** PCI-DSS (required for any store that handles card payments) and GDPR both demand that customer data be encrypted in transit — a missing HSTS header is a finding auditors flag. **Conversions:** Browsers display security warnings for mixed-content or downgrade scenarios; even a brief warning causes visitors to abandon their cart.

How do I fix missing strict transport security?

Add the Strict-Transport-Security (HSTS) response header to every HTTPS page so browsers always use an encrypted connection to your store.

Authoritative references

Related Security (OWASP) issues