If our website check reports “HSTS not enabled”, your website does not yet tell browsers to always open it via HTTPS.
What HSTS does
- After the first visit the browser only opens your site encrypted – even if someone types “http://” or follows an old link.
- It protects your customers' forms, enquiries and accounts, for example test-drive or workshop bookings.
- It saves one redirect and a few milliseconds of loading time.
Check first
Only enable HSTS if all pages run securely on HTTPS. With “include subdomains” it also applies to shop., portal., mail. and so on. Browsers remember HSTS for the configured period – going back to HTTP quickly is then not possible.
Enable it in Cloudflare
- Cloudflare → your domain → SSL/TLS → Edge Certificates.
- Under HTTP Strict Transport Security (HSTS) click “Enable HSTS” and confirm the notice.
- Start with a short max-age (e.g. 1 month), later raise it to 6–12 months.
- Only turn on “Include subdomains” if every subdomain has HTTPS. Leave “Preload” off for now.
Without Cloudflare
On your own server HSTS is set as a response header, for example in the Apache or Nginx configuration. Your host – or we – can help.
Then check with the HSTS checker or a full audit. Start a project