How to fix missing strict transport security on BigCommerce
Add the Strict-Transport-Security (HSTS) response header to every HTTPS page so browsers always use an encrypted connection to your store.
Steps for BigCommerce
- BigCommerce cloud storefronts serve all pages over HTTPS and the platform manages core transport security.
- Check whether the HSTS header is already present by opening browser DevTools → Network tab → click the homepage request → Response Headers.
- If the header is missing, it is most likely being dropped by a CDN or reverse proxy in front of your store. Log in to your CDN dashboard (e.g., Cloudflare: SSL/TLS → Edge Certificates → HSTS) and enable HSTS with max-age=31536000 and includeSubDomains.
- For BigCommerce Enterprise with a custom server-side layer, add the header in your proxy/middleware configuration.
- Contact BigCommerce support if the header is absent and no CDN is in use — this may be a platform-level configuration they need to adjust for your account.
What is missing strict transport security?
HTTP Strict Transport Security (HSTS) is a small instruction your web server sends inside every page response that tells browsers: "never load this site over plain HTTP — always use HTTPS, no exceptions." Without it, a browser will happily follow any link or redirect that starts with `http://`, even if your server immediately redirects to `https://`. That brief unencrypted moment is enough for an attacker on the same Wi-Fi network to intercept the request. The HSTS header closes that window entirely by making the browser refuse the insecure connection before it even leaves the device.
Security: Customers shopping on public Wi-Fi are vulnerable to SSL-stripping attacks — where a hacker silently downgrades their HTTPS session to plain HTTP and reads login cookies, payment info, or session tokens in the clear. HSTS prevents this. *SEO & Rankings:* Google uses HTTPS as a confirmed ranking signal and may deprioritize pages that can be reached over HTTP; a strong HSTS policy reinforces your site's "always-HTTPS" status. *Compliance & Legal:* PCI-DSS (required for any store that handles card payments) and GDPR both demand that customer data be encrypted in transit — a missing HSTS header is a finding auditors flag. *Conversions:* Browsers display security warnings for mixed-content or downgrade scenarios; even a brief warning causes visitors to abandon their cart.
See the complete Missing strict transport security guide for every platform and the full background.
Not sure if your BigCommerce store has this?
Run a free SEOLZ scan — we’ll find missing strict transport security and every other issue across your whole site.
Scan my site free