How to enable HSTS for Enhanced Web Security in Apache

HTTP Strict Transport Security (HSTS) is a security feature that helps protect websites from certain attacks. It makes sure that web browsers always use secure HTTPS connections to your website instead of the insecure HTTP protocol. This guide will show you how to set up and improve HSTS in Apache for better security.

1. Why Use HSTS?

Before we go into how to set it up, let’s talk about why HSTS is important. Using HSTS on your website can:

Advertisement

1. Stop man-in-the-middle attacks: HSTS makes sure that connections to your site are always secure, preventing attackers from downgrading connections from HTTPS to HTTP and spying on your users.
2. Stop cookie hijacking: By enforcing HTTPS, HSTS helps keep user cookies safe from attackers who might try to steal them.
3. Meet browser requirements: Some modern browsers require websites to use HTTPS and may show security warnings for sites that don’t. HSTS can help meet these requirements and provide a better browsing experience for users.

2. Configuring HSTS in Apache

To set up HSTS in Apache, you need to change your site’s configuration file and add the HSTS header. Here’s how to do it:

1. Access your Apache configuration file: This file could be named httpd.conf, apache2.conf, or ssl.conf, depending on your system. Often, you will find it in the /etc/apache2 or /etc/httpd directory.
2. Enable the headers module: HSTS is sent as an HTTP header, so you need to make sure the headers module is enabled. On Debian-based systems, you can enable it by typing the following commands in the terminal:

   sudo a2enmod headers 
   service apache2 restart 
   

3. Add the HSTS header: Open your configuration file in a text editor, locate the section for your site, and add this line inside the <VirtualHost *:443> block:

   
   <VirtualHost *:443>
       # ...
       # ....
       Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
       # ....
   </VirtualHost>
   
   

   This line tells browsers to use HTTPS for your site for the next year (31536000 seconds = 1 year), including all subdomains.

4. Restart Apache: Save your changes and exit the text editor. Then, restart Apache to apply the changes by typing the following command in the terminal:

   service apache2 restart 
   

You have now set up HSTS on your Apache server!

3. Optimizing HSTS in Apache

While the above steps enable HSTS on your server, you can take additional steps to make it better:

1. Use a long max-age: The max-age parameter tells browsers how long to remember to use HTTPS. A longer max-age (e.g., 1 year) provides better security, but if you stop using HTTPS, browsers will still try to access your site via HTTPS until the max-age expires.
2. Include subdomains: The includeSubDomains parameter tells browsers to use HTTPS for all subdomains of your site. Make sure all your subdomains support HTTPS before enabling this to avoid connection issues.
3. Preload HSTS: Preloading enforces HSTS even on the first visit to your site. To preload HSTS, add the preload directive in your HSTS configuration:

   
   Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
   
   

   After setting this up, you can submit your site to the HSTS preload list at https://hstspreload.org/. Remember, getting removed from the preload list can take months, so be sure about this step.

4. Renew your SSL certificate promptly: HSTS requires a valid SSL certificate. If your certificate expires and isn’t renewed quickly, browsers may show security warnings or block users from accessing your site.
5. Test your implementation: After setting up HSTS, use tools like the Qualys SSL Server Test to check that it is working correctly. This tool provides a detailed analysis of your server’s SSL setup and can find potential problems.

Conclusion

Setting up and improving HTTP Strict Transport Security (HSTS) on your Apache server is crucial for securing your website and protecting user data. By enforcing HTTPS connections, stopping protocol downgrade attacks, and preventing cookie hijacking, HSTS makes your website much safer.

By following this guide, you can use HSTS to make your Apache server more secure and build trust and confidence among your users.