How to enable HSTS for Enhanced Web Security in Nginx

HTTP Strict Transport Security (HSTS) is a security mechanism that helps to protect websites from man-in-the-middle attacks (MITMs). It does this by instructing browsers to only connect to the website using HTTPS, and to never downgrade to HTTP.

By enabling HSTS for your website, you can help to make it more secure and protect your users from attack.

Advertisement

Enabling HSTS in Nginx

1. Open your Nginx configuration file: The location of this file may vary depending on your operating system and Nginx setup. On Debian-based systems, the file is typically located in the /etc/nginx/nginx.conf directory.

   sudo nano /etc/nginx/nginx.conf 
   

2. Add the HSTS header to your configuration file: The HSTS header is added to your Nginx configuration file. The following is an example of how to add the HSTS header to your Nginx configuration file:
   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";

   1	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";

   The `max-age` parameter specifies the amount of time that the browser should remember the HSTS policy. The `includeSubDomains` parameter specifies that the HSTS policy should apply to all subdomains of the domain. The `preload` parameter tells the browser to cache the HSTS policy in its permanent storage, so that it can be used even if the browser is not currently connected to the internet.

3. Restart Nginx: Once you have added the HSTS header to your configuration file, you need to restart Nginx. This will apply the changes and enable HSTS for your website. To restart Nginx, you can use the following command in the terminal:

   sudo service nginx restart 
   

4. Test HSTS: Once you have enabled HSTS, you can test it by visiting your website in a web browser. The browser should display a message indicating that the website is using HSTS.

For example, in Google Chrome, you will see a message that says “This connection is protected by HSTS.”

Conclusion

Enabling HSTS for your website is a simple and effective way to improve its security. By following the steps in this article, you can easily enable HSTS for your Nginx server and help to protect your users from attack.

Here are some additional tips for using HSTS:

• Make sure that your website is always using HTTPS.
• If you are using a wildcard certificate, make sure that the HSTS header is also applied to the wildcard domain.
• Submit your domain to the HSTS preload list. This will tell browsers to cache the HSTS policy for your domain even if it is not currently connected to the internet.

By following these tips, you can help to protect your website from MITM attacks.