How to fix missing strict transport security on Magento Open Source

Steps for Magento Open Source

1. Follow the same Apache or Nginx server-level steps as Adobe Commerce (Magento) above — the process is identical for the open-source edition.
2. Edit your HTTPS VirtualHost (Apache) or server block (Nginx) to add the Strict-Transport-Security header as shown in the code snippets below.
3. Ensure mod_headers (Apache) or the ngx_http_headers_module (Nginx, compiled in by default) is active.
4. Flush the Magento cache after any configuration change: php bin/magento cache:flush.

What is missing strict transport security?

HTTP Strict Transport Security (HSTS) is a small instruction your web server sends inside every page response that tells browsers: "never load this site over plain HTTP — always use HTTPS, no exceptions." Without it, a browser will happily follow any link or redirect that starts with `http://`, even if your server immediately redirects to `https://`. That brief unencrypted moment is enough for an attacker on the same Wi-Fi network to intercept the request. The HSTS header closes that window entirely by making the browser refuse the insecure connection before it even leaves the device.

Security: Customers shopping on public Wi-Fi are vulnerable to SSL-stripping attacks — where a hacker silently downgrades their HTTPS session to plain HTTP and reads login cookies, payment info, or session tokens in the clear. HSTS prevents this. *SEO & Rankings:* Google uses HTTPS as a confirmed ranking signal and may deprioritize pages that can be reached over HTTP; a strong HSTS policy reinforces your site's "always-HTTPS" status. *Compliance & Legal:* PCI-DSS (required for any store that handles card payments) and GDPR both demand that customer data be encrypted in transit — a missing HSTS header is a finding auditors flag. *Conversions:* Browsers display security warnings for mixed-content or downgrade scenarios; even a brief warning causes visitors to abandon their cart.

See the complete Missing strict transport security guide for every platform and the full background.