How to fix missing strict transport security on PrestaShop

Steps for PrestaShop

1. Log in to your hosting control panel or SSH into your server.
2. For Apache hosting: Edit the .htaccess file in your PrestaShop root directory OR your Apache VirtualHost config for the HTTPS site. Add the HSTS Header directive from the Apache snippet below.
3. For Nginx hosting: Edit your Nginx server block for port 443 and add the add_header directive from the Nginx snippet below, then reload Nginx.
4. Alternatively, use a PrestaShop security module (e.g., 'HTTP Headers Manager' from the Addons Marketplace) that lets you set security headers from the PrestaShop back office.
5. Go to Admin → Shop Parameters → General and ensure 'Force SSL for all pages' (SSL enabled on all pages) is set to Yes before deploying HSTS.
6. Verify the header is present in browser DevTools after saving.

What is missing strict transport security?

HTTP Strict Transport Security (HSTS) is a small instruction your web server sends inside every page response that tells browsers: "never load this site over plain HTTP — always use HTTPS, no exceptions." Without it, a browser will happily follow any link or redirect that starts with `http://`, even if your server immediately redirects to `https://`. That brief unencrypted moment is enough for an attacker on the same Wi-Fi network to intercept the request. The HSTS header closes that window entirely by making the browser refuse the insecure connection before it even leaves the device.

Security: Customers shopping on public Wi-Fi are vulnerable to SSL-stripping attacks — where a hacker silently downgrades their HTTPS session to plain HTTP and reads login cookies, payment info, or session tokens in the clear. HSTS prevents this. *SEO & Rankings:* Google uses HTTPS as a confirmed ranking signal and may deprioritize pages that can be reached over HTTP; a strong HSTS policy reinforces your site's "always-HTTPS" status. *Compliance & Legal:* PCI-DSS (required for any store that handles card payments) and GDPR both demand that customer data be encrypted in transit — a missing HSTS header is a finding auditors flag. *Conversions:* Browsers display security warnings for mixed-content or downgrade scenarios; even a brief warning causes visitors to abandon their cart.

See the complete Missing strict transport security guide for every platform and the full background.