Enable HTTP Strict Transport Security (HSTS) for IIS Print

HTTP Strict Transport Security (HSTS) is an optional security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this header, it prevents any communication to the specified domain from being sent over HTTP and instead, sends it over HTTPS. It also prevents HTTPS click-through prompts on browsers.

Open the web.config file and perform the following transformations:

<!-- Add the custom header, by adding the following: -->

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="Strict-Transport-Security" value="max-age=31536000"/>
    </customHeaders>
  </httpProtocol>
</system.webServer>

<!-- Add the URL rewrite rules, by finding <system.webServer> tag and after the handlers section, adding the following: -->

<rewrite>
  
  <rules>
    <rule name="HTTP to HTTPS redirect" stopProcessing="true">
      <match url="(.*)" />
      <conditions>
        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
      </conditions>
      <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
    </rule>
  </rules>
  
  <outboundRules>
    <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
      <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
      <conditions>
        <add input="{HTTPS}" pattern="on" ignoreCase="true" />
      </conditions>
      <action type="Rewrite" value="max-age=31536000" />
    </rule>
  </outboundRules>

</rewrite>

NOTE: You are always sending the header - even when you are not under HTTPS.

The first rule is redirecting always from HTTP to HTTPS, while the second one is adding Strict-Transport-Security header.

NOTE: If you have a load-balanced environment, the HSTS header can be configured on the load balancer instead of the webserver.