PCI - How to enable HSTS on a cPanel server.

Introduction

This article will detail the necessary steps to enable HSTS on a cPanel server.

Procedure

1. Log into WHM as the 'root' user.
2. Navigate to "WHM / Service Configuration / Apache Configuration."
3. Click "Include Editor."
4. Select "All Versions" from the drop-down menu under "Pre-Main Include."
5. Add the following text.

   <IfModule mod_headers.c>
   Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
   Header always edit Set-Cookie (.*) "$1;HttpOnly;Secure"
   Header always set X-Frame-Options "sameorigin"
   Header setifempty Referrer-Policy: same-origin
   Header set X-XSS-Protection "1; mode=block"
   Header set X-Permitted-Cross-Domain-Policies "none"
   Header set Referrer-Policy "no-referrer"
   Header set X-Content-Type-Options: nosniff
   </IfModule>

6. Click the "Update" button.
7. Click the "Restart Apache" button.

To confirm that your site now has the strict-transport-security header, run the following command:

read -p "Domain: " domain ; curl -sI https://${domain}/ | grep -i Strict-Transport-Security

The command above will request a domain. Here is an example:

[root@server ~]cPs# read -p "Domain: " domain ; curl -sI https://${domain}/ | grep -i Strict-Transport-Security
Domain: domain.tld
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Additional resources

Apache Configuration

Include Editor