PCI - How to enable HSTS on a cPanel server.

Question

How to enable HSTS on a cPanel server?

Answer

1. Log into WHM as the root user.
2. Navigate to WHM / Service Configuration / Apache Configuration.
3. Click Include Editor.
4. Select All Versions from the drop-down menu under Pre-Main Include.

5. Add the following text.

   CONFIG_TEXT: <IfModule mod_headers.c>
   Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
   Header always edit Set-Cookie (.*) "$1;HttpOnly;Secure"
   Header always set X-Frame-Options "sameorigin"
   Header setifempty Referrer-Policy: same-origin
   Header set X-XSS-Protection "1; mode=block"
   Header set X-Permitted-Cross-Domain-Policies "none"
   Header set Referrer-Policy "no-referrer"
   Header set X-Content-Type-Options: nosniff
   </IfModule>

6. Click the Update button.
7. Click the Restart Apache button.

To confirm that your site now has the strict-transport-security header, run the following command:

# read -p "Domain: " domain ; curl -sI https://${domain}/ | grep -i Strict-Transport-Security

The command above will request a domain. Here is an example:

# [root@server ~]cPs# read -p "Domain: " domain ; curl -sI https://${domain}/ | grep -i Strict-Transport-Security
Domain: domain.tld
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Additional resources

Apache Configuration

Include Editor