HSTS

This feature will add the required HTTP Strict Transport Security headers to the request according to the .

note

HSTS policy headers are ignored over an insecure HTTP connection. For HSTS to take effect, it should be served over a secure (https) connection.

When the browser receives HSTS policy headers, it will no longer attempt to connect to the server with insecure connections for the given period of time.

Configuration

• (default is 1 year): duration to tell the client to keep the host in a list of known HSTS hosts

• (default is empty): any custom directives supported by specific user-agent