Articles in this section

How to enable/disable HTTP Strict-Transport-Security (HSTS) for a domain in Plesk?

Anton Kuznetsov
Updated
Plesk for Windows kb: how-to Plesk for Linux ABT: Group B

Applicable to:

  • Plesk for Linux
  • Plesk for Windows

Question

How to enable/disable HTTP Strict-Transport-Security (HSTS) for a domain in Plesk?

Answer

Note: A valid SSL certificate must be installed on the website, otherwise it'll not be accessible.

Note: The HSTS header won't be sent while the preferred domain is "www". 

  1. Log into Plesk
  2. Install SSL It! extension in Extensions
  3. Navigate to Domains > example.com > Hosting Settings and make sure SSL/TLS support is enabled
  4. Navigate to Domains > example.com > SSL/TLS Certificates

  5. Click on the HSTS button:

    mceclip0.png

  6. Configure the HSTS options and click on Enable (or Disable) HSTS:

    mceclip1.png

Was this article helpful?

Comments

3 comments
Date Votes
  • Avatar
    Oliver Tief

    Plesk tells me that HSTS is active, but it is not working with preload. It would be nice to know how to enable HSTS Preload also.

    0
  • Avatar
    Jon Doe

    Nevermind, I just realized you were probably asking how to enabled Preload in Plesk, not in general. Seems like Plesk is still missing support for that.

    0
  • Avatar
    Charles Dobbs

    It seems HSTS is default state is on. Where is the setting to change this to off?

    When creating a temporary domain for testing, it doesn't have a certificate and you can not create one. It is a temporary domain. So you can not access you temporary domain.

    0

Please sign in to leave a comment.