Enable HTTP Strict Transport Security (HSTS) for IIS Print

  • 106

HTTP Strict Transport Security (HSTS) is an optional security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this header, it prevents any communication to the specified domain from being sent over HTTP and instead, sends it over HTTPS. It also prevents HTTPS click-through prompts on browsers.

Open the web.config file and perform the following transformations:

<!-- Add the custom header, by adding the following: -->

      <add name="Strict-Transport-Security" value="max-age=31536000"/>

<!-- Add the URL rewrite rules, by finding <system.webServer> tag and after the handlers section, adding the following: -->

    <rule name="HTTP to HTTPS redirect" stopProcessing="true">
      <match url="(.*)" />
        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
      <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
    <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
      <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
        <add input="{HTTPS}" pattern="on" ignoreCase="true" />
      <action type="Rewrite" value="max-age=31536000" />


NOTE: You are always sending the header - even when you are not under HTTPS.

The first rule is redirecting always from HTTP to HTTPS, while the second one is adding Strict-Transport-Security header.

NOTE: If you have a load-balanced environment, the HSTS header can be configured on the load balancer instead of the webserver.

Was this answer helpful?

« Back