I am trying to setup HSTS for my website but running into some problems regarding the response headers and the use of a sub domain. What I would like is for all HTTP traffic to redirect to https://www.example.co.uk
.
I have been using the information on the following website as a guide: https://www.danielmorell.com/blog/how-to-configure-hsts-on-www-and-other-subdomains.
The examples on the above website show the strict-transport-security (STS) header at all the redirect stages.
E.g. http://example.com
301 redirects to https://example.com
(STS in header). Then https://example.com
redirects to https://www.example.com
(STS in header).
However when I try my own domain I only get the STS header on the initial redirect and not the next redirection to the https://www.
sub domain.
Examples from my own testing:
http://example.co.uk
(301) tohttps://example.co.uk
(STS in header) (301) tohttps://www.example.co.uk
(No STS in header).http://www.example.co.uk
(301) tohttps://www.example.co.uk
(No STS in header).https://example.co.uk
(STS in header) then (301) tohttps://www.example.co.uk
(No STS in header).https://www.example.co.uk
(No STS in header).
Below is a copy of the header response using option 1 above:
http://example.co.uk
HTTP/1.1 301 Moved Permanently
Date: Mon, 04 Feb 2019 18:14:30 GMT
Server: Apache
Location: `https://example.co.uk`/
Content-Length: 237
Content-Type: text/html; charset=iso-8859-1
https://example.co.uk
/
HTTP/1.1 301 Moved Permanently
Date: Mon, 04 Feb 2019 18:14:33 GMT
Server: Apache
Strict-Transport-Security: max-age=31557600; includeSubDomains;
Location: https://www.example.co.uk/
Content-Length: 241
Content-Type: text/html; charset=iso-8859-1
https://www.example.co.uk/
HTTP/1.1 200 OK
Date: Mon, 04 Feb 2019 18:14:35 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=fkjqaomopnp03uforuptdu3u17; path=/
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1
I'm just wondering if my setup is working correctly or should the strict-transport-security header appear in the header response from the https://www.
sub domain as well.
My website is running on a shared Apache server. I have a valid Le's encrypt cert with CN = example.co.uk
.
I have tried the suggestions at: HSTS implementation when using www.TLD but it didn't seem to solve my problem.
My .htaccess is shown below:
<if "%{HTTPS} == 'on'">
Header always set Strict-Transport-Security "max-age=31557600; includeSubDomains;"
</if>
## Base Redirects ##
# Turn on Rewrite Engine
RewriteEngine On
# Redirect to secure HTTPS before changing host
RewriteCond %{HTTP_HOST} !^www\.(.*)$ [NC]
RewriteCond %{https} off
RewriteRule ^(.*)$ https://example.co.uk/$1 [R=301,L]
# Remove trailing slash from non-filepath urls
RewriteCond %{REQUEST_URI} /(.+)/$
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ https://www.example.co.uk/%1 [R=301,L]
# Include trailing slash on directory
RewriteCond %{REQUEST_URI} !(.+)/$
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^(.+)$ https://www.example.co.uk/$1/ [R=301,L]
# Force HTTPS and WWW
RewriteCond %{HTTP_HOST} !^www\.(.*)$ [OR,NC]
RewriteCond %{https} off
RewriteRule ^(.*)$ https://www.example.co.uk/$1 [R=301,L]