HTTP Strict Transport Security (HSTS) protects your CDN domains against downgrade attacks, where an attacker intercepts an initial HTTP connection and redirects traffic to a malicious server before the browser can upgrade to HTTPS. Once enabled, HSTS instructs browsers to:
Reject plain HTTP connections and enforce HTTPS for all subsequent requests
Block users from bypassing SSL certificate warnings
Prerequisites
Before you begin, make sure you have:
An SSL certificate configured for the accelerated domain name. See Configure an SSL certificate.
How it works
When a browser connects to a point of presence (POP) over HTTPS for the first time, the POP returns a Strict-Transport-Security response header. The browser then enforces HTTPS-only connections for the domain until the header's TTL expires.
The header format is:
Strict-Transport-Security: max-age=<seconds> [;includeSubDomains] [;preload]| Parameter | Required | Description |
|---|---|---|
max-age | Yes | Duration (in seconds) that browsers enforce HTTPS-only connections. |
includeSubDomains | No | Extends the HSTS policy to all subdomains of the accelerated domain name. |
preload | No | Adds the domain to the browser's built-in HSTS preload list. |
For the first HTTP request before HSTS is synchronized to a browser, the POP returns an HTTP 301 redirect to HTTPS. This prevents security exposure during the initial connection.
Limitations
Before enabling HSTS, review the following:
HSTS applies only to domain names, not IP addresses.
Do not configure URL redirection to HTTP at the same time as HSTS. Browsers will be unable to access the domain.
Before enabling Include Subdomains, make sure HTTPS is configured for all subdomains. If any subdomain does not have HTTPS enabled, it becomes inaccessible after the policy takes effect.
Disabling HSTS does not take effect immediately on clients. The updated policy is delivered to each browser on its next HTTPS request.
Enable HSTS
Log on to the CDN console.
In the left navigation pane, click Domain Names.
Find the target domain name and click Manage in the Actions column.
In the domain's navigation pane, click HTTPS.
In the HSTS section, click Modify.
In the Configure HSTS dialog box, turn on HSTS and configure the following parameters:
Parameter Description Expire In TTL for the HSTS header cached in the browser, in days. Set to 60 days. Set to 0 to disable HSTS. Include Subdomains Extends the HSTS policy to all subdomains. Enable only after confirming HTTPS is active on every subdomain. 
Click OK.
Disable HSTS
To disable HSTS, set Expire In to 0 in the Configure HSTS dialog box and click OK. The browser applies the updated policy on its next HTTPS request to the POP.