{"id":8643,"date":"2026-05-28T23:52:17","date_gmt":"2026-05-28T21:52:17","guid":{"rendered":"https:\/\/mybox.com\/help\/?post_type=manual_kb&#038;p=8643"},"modified":"2026-06-15T01:10:18","modified_gmt":"2026-06-14T23:10:18","slug":"how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening","status":"publish","type":"manual_kb","link":"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/","title":{"rendered":"How to Enable HSTS in Cloudflare"},"content":{"rendered":"\n<div class=\"translation-block translation-block-merged\">\n<p class=\"wp-block-paragraph\">HTTP Strict Transport Security (HSTS) is a security feature that instructs web browsers to connect to your website using HTTPS only. Once enabled, visitors&#8217; browsers will automatically use encrypted connections and reject insecure HTTP connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Before enabling HSTS, make sure your website is already accessible via HTTPS and that your SSL certificate is working correctly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 ez-toc-wrap-left counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Step_1_Log_in_to_Cloudflare\" >Step 1: Log in to Cloudflare<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Step_2_Open_SSLTLS_Settings\" >Step 2: Open SSL\/TLS Settings<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Step_3_Enable_HSTS\" >Step 3: Enable HSTS<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Step_4_Configure_HSTS_Settings\" >Step 4: Configure HSTS Settings<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Max_Age\" >Max Age<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Include_Subdomains\" >Include Subdomains<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Preload\" >Preload<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Step_5_Save_the_Configuration\" >Step 5: Save the Configuration<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Important_Notes\" >Important Notes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/how-to-activate-hsts-in-cloudflare-step-by-step-security-hardening\/#Summary\" >Summary<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_1_Log_in_to_Cloudflare\"><\/span>Step 1: Log in to Cloudflare<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<\/div>\n\n<div id=\"mybox-4060648789\" class=\"mybox-content mybox-entity-placement\"><div class=\"early-access-banner-inpost\">\r\n  <div class=\"banner-left-inpost\">\r\n    <div class=\"icon-box-inpost\">\r\n      <img decoding=\"async\" src=\"https:\/\/mybox.com\/help\/wp-content\/uploads\/2026\/02\/square-info-icon.svg\" alt=\"Info\">\r\n    <\/div>\r\n    <div class=\"text-box-inpost\">\r\n      <span class=\"label-inpost\"><span class=\"translation-block translation-block-banner-text\">Early access<\/span><\/span>\r\n      <h4><span class=\"translation-block translation-block-banner-text\">Still need help?<\/span><\/h4>\r\n      <p><span class=\"translation-block translation-block-banner-text\">Contact our customer service team.<\/span><\/p>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <div class=\"banner-right-inpost\">\r\n    <a href=\"https:\/\/panel.mybox.com\/helpdesk2\/v\/list\/\" class=\"banner-button-inpost\"><span class=\"translation-block translation-block-banner-text\">Message us<\/span><\/a>\r\n  <\/div>\r\n<\/div><\/div>\n\n<div class=\"translation-block translation-block-merged\"><p class=\"wp-block-paragraph\">Log in to your Cloudflare account and select the website you want to configure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_2_Open_SSLTLS_Settings\"><\/span>Step 2: Open SSL\/TLS Settings<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">From the left-hand menu, navigate to:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>SSL\/TLS \u2192 Edge Certificates<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_3_Enable_HSTS\"><\/span>Step 3: Enable HSTS<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Scroll down to the <strong>HTTP Strict Transport Security (HSTS)<\/strong> section and click <strong>Enable HSTS<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cloudflare will display a warning explaining the implications of enabling HSTS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_4_Configure_HSTS_Settings\"><\/span>Step 4: Configure HSTS Settings<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can configure the following options:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Max_Age\"><\/span>Max Age<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This determines how long browsers should remember the HSTS policy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For initial testing, a shorter period such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1 month\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">is recommended.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After confirming everything works correctly, you can increase the duration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Include_Subdomains\"><\/span>Include Subdomains<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Enable this option if all subdomains also support HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only enable it if every subdomain is accessible securely.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Preload\"><\/span>Preload<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The preload option allows your domain to be included in browser HSTS preload lists.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enable this option only if:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HTTPS is permanently enabled on the entire domain.<\/li>\n\n\n\n<li>All subdomains support HTTPS.<\/li>\n\n\n\n<li>You understand that removing a preloaded domain can take months.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_5_Save_the_Configuration\"><\/span>Step 5: Save the Configuration<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click <strong>Save<\/strong> to apply the changes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your website will now instruct browsers to use HTTPS connections exclusively.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Important_Notes\"><\/span>Important Notes<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure HTTPS is working correctly before enabling HSTS.<\/li>\n\n\n\n<li>Do not enable <strong>Include Subdomains<\/strong> unless all subdomains support HTTPS.<\/li>\n\n\n\n<li>Be cautious when enabling <strong>Preload<\/strong>, as it can be difficult to reverse.<\/li>\n\n\n\n<li>Test your website thoroughly after enabling HSTS to ensure there are no mixed-content or certificate-related issues.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Summary\"><\/span>Summary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HSTS is an additional security layer that helps protect visitors against downgrade attacks and accidental HTTP connections. When configured correctly in Cloudflare, it improves the security of your website by ensuring browsers always use HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"template":"","format":"standard","manualknowledgebasecat":[12],"manual_kb_tag":[936,1319,7006,7007,7008,7011,7012,7015,7016,7017],"class_list":["post-8643","manual_kb","type-manual_kb","status-publish","format-standard","hentry","manualknowledgebasecat-cloudflare","manual_kb_tag-cloudflare","manual_kb_tag-max-age","manual_kb_tag-strict-transport-security","manual_kb_tag-http-strict-transport-security","manual_kb_tag-hsts","manual_kb_tag-hsts-preload","manual_kb_tag-https-enforcement","manual_kb_tag-edge-certificates","manual_kb_tag-enable-hsts","manual_kb_tag-include-subdomains"],"_links":{"self":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/8643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb"}],"about":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/types\/manual_kb"}],"author":[{"embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":3,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/8643\/revisions"}],"predecessor-version":[{"id":8644,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/8643\/revisions\/8644"}],"wp:attachment":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/media?parent=8643"}],"wp:term":[{"taxonomy":"manualknowledgebasecat","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manualknowledgebasecat?post=8643"},{"taxonomy":"manual_kb_tag","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb_tag?post=8643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}