Skip to main content

PCI - How to enable HSTS on a cPanel server.

James Wright
  • Updated

Introduction

This article will detail the necessary steps to enable HSTS on a cPanel server.

 

Procedure

  1. Log into WHM as the 'root' user.
  2. Navigate to "WHM / Service Configuration / Apache Configuration."
  3. Click "Include Editor."
  4. Select "All Versions" from the drop-down menu under "Pre-Main Include."
  5. Add the following text. 
    <IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always edit Set-Cookie (.*) "$1;HttpOnly;Secure"
    Header always set X-Frame-Options "sameorigin"
    Header setifempty Referrer-Policy: same-origin
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Permitted-Cross-Domain-Policies "none"
    Header set Referrer-Policy "no-referrer"
    Header set X-Content-Type-Options: nosniff
    </IfModule>
  6. Click the "Update" button.
  7. Click the "Restart Apache" button.

To confirm that your site now has the strict-transport-security header, run the following command:

read -p "Domain: " domain ; curl -sI https://${domain}/ | grep -i Strict-Transport-Security

The command above will request a domain. Here is an example:

[root@server ~]cPs# read -p "Domain: " domain ; curl -sI https://${domain}/ | grep -i Strict-Transport-Security
Domain: domain.tld
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

 

Additional resources

Apache Configuration

Include Editor

Related articles