Auto SSL
Every hostname needs a valid certificate before HSTS makes the HTTP fallback unavailable.
Open the topicCDN.com.tr Help
Turn on HSTS for your hostnames
The Hsts security preset makes the edge send Strict-Transport-Security: max-age=31536000 on HTTPS responses, so a browser that has seen your site once refuses to open it over plain HTTP for a year.
Cache, security, WAF, and purge
Turn on HSTS for your hostnames
The Hsts security preset makes the edge send Strict-Transport-Security: max-age=31536000 on HTTPS responses, so a browser that has seen your site once refuses to open it over plain HTTP for a year.
Panel path
- Management Panel
- CDN Accounts
- Delivery Rules
- Security defaults
- Security Setting (preset multiselect)
Prerequisites
- Every hostname served by this account must already work over HTTPS with a valid certificate — including asset hosts and any subdomain you link to from the site.
- Mixed content must be cleaned up first. Once HSTS is in force, an http:// asset is not retried over HTTP, it simply fails.
- You need a role that can save delivery rules: owner or editor. A viewer can read the page but not submit it.
Decision model
Are you ready for HSTS?
This is the only real decision. HSTS is safe on a site that is fully on HTTPS and painful on one that is not.
- Ready: every hostname on the account, and every asset it loads, answers on HTTPS with a valid certificate.
- Not ready: an image host, an old subdomain, or an internal tool still answers on HTTP only. Fix those first.
- Unsure: open your own site with the browser console visible and look for mixed-content warnings before turning the preset on.
What this preset does and does not cover
Knowing the exact scope avoids both over-confidence and a support ticket asking why a subdomain is unaffected.
- Covers: the hostname that served the response, for one year, over HTTPS.
- Does not cover: subdomains — the header carries no includeSubDomains directive.
- Does not cover: preload lists — the site is not submitted to browser vendors.
Step-by-step guide
Check that HTTPS is complete
This step is the whole risk of the feature. Everything after it is two clicks.
- Open your site with the developer console visible and look for mixed-content warnings.
- List the hostnames on the account in Content Delivery Points and open each one over https://.
- Confirm each certificate is valid and not close to expiry in SSL Management.
Expected result: Every hostname on the account loads over HTTPS without certificate or mixed-content warnings.
cdnctl equivalent
curl -sI https://www.example.com/ | head -1
curl -sI https://assets.example.com/ | head -1Add the Hsts preset
The Security Setting field is a multiselect of security presets. Adding Hsts leaves the others in place.
- Select the account and open Delivery Rules.
- Scroll to Security defaults and click the Security Setting field (its placeholder invites you to select or search a preset).
- Choose Hsts from the list, keep any preset that was already selected, and submit.
Expected result: The preset set is saved and a deploy is queued, so the edge configuration is regenerated with the HSTS include.
cdnctl equivalent
POST /api/accounts/update_account_presets/<account_uuid>
{"type":"security","presets":["Waf","Hsts"]}
The call replaces the whole preset set for that type — send every preset you want to keep.Verify the header on a real request
A saved preset is an intention; the response header is the fact.
- Run the HTTPS check below and confirm the header and its max-age value.
- Run the same check over http:// and confirm the header is absent there — that is the correct behaviour.
- Open the site in a fresh browser profile and confirm nothing broke.
Expected result: The HTTPS response carries Strict-Transport-Security: max-age=31536000 and the site loads normally.
cdnctl equivalent
curl -sI https://www.example.com/ | grep -i strict-transport
curl -sI http://www.example.com/ | grep -i strict-transportVerification
- The HTTPS response carries Strict-Transport-Security: max-age=31536000.
- The plain HTTP response does not carry it.
- No hostname on the account is HTTP-only any more, and no page reports mixed content.
- You have accepted that unticking the preset does not clear the header from browsers that already stored it.
Use cases
Your site is fully on HTTPS and you want to close the first-request gap: the first click of the day still goes out as http:// and only then gets redirected. HSTS removes that request entirely — the browser upgrades it before it leaves the machine.
Quick workflow
- Confirm every hostname on the account already answers on HTTPS with a valid certificate. HSTS takes the HTTP fallback away, so anything still HTTP-only becomes unreachable for visitors who have seen the header.
- Open Delivery Rules for the account and find the Security defaults panel.
- Open the Security Setting preset field, pick Hsts, and submit. Presets that were already selected, such as Waf, stay selected — the field is a multiselect and the save replaces the whole set.
- Wait for the configuration to reach the edge, then verify the header on a real request.
Checks
- The header is sent on HTTPS responses only. Seeing no Strict-Transport-Security on an http:// response is correct, not a fault.
- The value is max-age=31536000 — one year — with no includeSubDomains and no preload. Subdomains are not covered by this preset; each hostname is pinned by its own response.
- The site is not submitted to any browser preload list, so removing HSTS never needs a request to a browser vendor.
- Untick the preset and the edge stops sending the header — but browsers that already received it keep forcing HTTPS until their stored max-age runs out. Treat HSTS as a one-way door for up to a year, not as a toggle you flip during a test.