1

I am trying to setup HSTS for my website but running into some problems regarding the response headers and the use of a sub domain. What I would like is for all HTTP traffic to redirect to https://www.example.co.uk.

I have been using the information on the following website as a guide: https://www.danielmorell.com/blog/how-to-configure-hsts-on-www-and-other-subdomains.

The examples on the above website show the strict-transport-security (STS) header at all the redirect stages.

E.g. http://example.com 301 redirects to https://example.com (STS in header). Then https://example.com redirects to https://www.example.com (STS in header).

However when I try my own domain I only get the STS header on the initial redirect and not the next redirection to the https://www. sub domain.

Examples from my own testing:

  1. http://example.co.uk (301) to https://example.co.uk (STS in header) (301) to https://www.example.co.uk (No STS in header).

  2. http://www.example.co.uk (301) to https://www.example.co.uk (No STS in header).

  3. https://example.co.uk (STS in header) then (301) to https://www.example.co.uk (No STS in header).

  4. https://www.example.co.uk (No STS in header).

Below is a copy of the header response using option 1 above:

http://example.co.uk

HTTP/1.1 301 Moved Permanently
Date: Mon, 04 Feb 2019 18:14:30 GMT
Server: Apache
Location: `https://example.co.uk`/
Content-Length: 237
Content-Type: text/html; charset=iso-8859-1

https://example.co.uk/

HTTP/1.1 301 Moved Permanently
Date: Mon, 04 Feb 2019 18:14:33 GMT
Server: Apache
Strict-Transport-Security: max-age=31557600; includeSubDomains;
Location: https://www.example.co.uk/
Content-Length: 241
Content-Type: text/html; charset=iso-8859-1

https://www.example.co.uk/

HTTP/1.1 200 OK
Date: Mon, 04 Feb 2019 18:14:35 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=fkjqaomopnp03uforuptdu3u17; path=/
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1

I'm just wondering if my setup is working correctly or should the strict-transport-security header appear in the header response from the https://www. sub domain as well.

My website is running on a shared Apache server. I have a valid Le's encrypt cert with CN = example.co.uk.

I have tried the suggestions at: HSTS implementation when using www.TLD but it didn't seem to solve my problem.

My .htaccess is shown below:

<if "%{HTTPS} == 'on'">
  Header always set Strict-Transport-Security "max-age=31557600; includeSubDomains;"
</if>

## Base Redirects ##

# Turn on Rewrite Engine
RewriteEngine On

# Redirect to secure HTTPS before changing host
RewriteCond %{HTTP_HOST} !^www\.(.*)$ [NC]
RewriteCond %{https} off  
RewriteRule ^(.*)$ https://example.co.uk/$1 [R=301,L]

# Remove trailing slash from non-filepath urls
RewriteCond %{REQUEST_URI} /(.+)/$
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ https://www.example.co.uk/%1 [R=301,L]

# Include trailing slash on directory 
RewriteCond %{REQUEST_URI} !(.+)/$
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^(.+)$ https://www.example.co.uk/$1/ [R=301,L]

# Force HTTPS and WWW 
RewriteCond %{HTTP_HOST} !^www\.(.*)$ [OR,NC]
RewriteCond %{https} off  
RewriteRule ^(.*)$ https://www.example.co.uk/$1 [R=301,L]
  • This article appears to be a good reference for this question: sentinelstand.com/article/… – Stephen Ostermiller Feb 4 at 22:01
  • @StephenOstermiller Thanks for your reply. I tried the suggestion in the piece about creating a 1px image, requesting it from https:// www.example.co.uk using https:// example.co.uk but it didn't work. The code used was <img src="https:// example.co.uk/a.gif" style="display: none;" />. I also tested one of my sub domains https:// m.example.co.uk and it set the HSTS header. I created 2 more sub domains: https:// test.example.co.uk and https:// a.example.co.uk and both set the HSTS header so the includeSubDomains directive is working. So the issue appears to be with the https:// www. sub domain. – Ross Hodgman Feb 6 at 0:25
  • I've spoken to my host and they can't see any problems their end and have suggested I ask a developer for advice regarding the redirects and HSTS isssue. – Ross Hodgman Feb 6 at 17:45

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.