How to fix missing strict transport security on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. SSH into your server or open your hosting control panel.
2. For Apache: Edit the VirtualHost block in your HTTPS (port 443) configuration file (e.g. /etc/apache2/sites-available/yourdomain.conf) and add: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains". Enable mod_headers if not already active: a2enmod headers && systemctl restart apache2.
3. For Nginx: Edit your server block config and add: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; inside the server { listen 443 ssl; } block, then run: nginx -t && systemctl reload nginx.
4. Alternatively, in Adobe Commerce Admin go to Stores → Configuration → General → Web → Base URLs (Secure) and ensure all URLs use https://. Then set Use Secure URLs on Storefront and Use Secure URLs in Admin both to Yes. This does not add the HSTS header itself but ensures no HTTP fallback occurs alongside your server-level header.
5. Flush the Magento cache: Admin → System → Cache Management → Flush Magento Cache.
6. Verify with browser DevTools that the header appears on the storefront, admin, and any subdomain used for static assets.

What is missing strict transport security?

HTTP Strict Transport Security (HSTS) is a small instruction your web server sends inside every page response that tells browsers: "never load this site over plain HTTP — always use HTTPS, no exceptions." Without it, a browser will happily follow any link or redirect that starts with `http://`, even if your server immediately redirects to `https://`. That brief unencrypted moment is enough for an attacker on the same Wi-Fi network to intercept the request. The HSTS header closes that window entirely by making the browser refuse the insecure connection before it even leaves the device.

Security: Customers shopping on public Wi-Fi are vulnerable to SSL-stripping attacks — where a hacker silently downgrades their HTTPS session to plain HTTP and reads login cookies, payment info, or session tokens in the clear. HSTS prevents this. *SEO & Rankings:* Google uses HTTPS as a confirmed ranking signal and may deprioritize pages that can be reached over HTTP; a strong HSTS policy reinforces your site's "always-HTTPS" status. *Compliance & Legal:* PCI-DSS (required for any store that handles card payments) and GDPR both demand that customer data be encrypted in transit — a missing HSTS header is a finding auditors flag. *Conversions:* Browsers display security warnings for mixed-content or downgrade scenarios; even a brief warning causes visitors to abandon their cart.

See the complete Missing strict transport security guide for every platform and the full background.