HSTS and Security Headers
HTTP Strict Transport Security and essential security headers for production.
EdgeIntermediate
Why
HSTS forces HTTPS for all visits, preventing SSL stripping and protocol downgrade attacks. Cloudflare's edge network spans 330+ cities with sub-50ms p95 latency globally.
Edge functions reduce TTFB by 60-80% compared to origin servers, and Akamai reports 40% of enterprises now use edge compute in 2024.
When
All HTTPS production sites — especially those handling authentication. Avoid edge functions for stateful logic requiring database writes — edge runtimes have no persistent connection pool.
Skip if you need long-running tasks (>30s) or heavy CPU computation.
How
# vercel.json security headers
{
"headers": [{
"source": "/(.*)",
"headers": [
{ "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains; preload" },
{ "key": "X-Content-Type-Options", "value": "nosniff" },
{ "key": "X-Frame-Options", "value": "DENY" },
{ "key": "X-XSS-Protection", "value": "1; mode=block" },
{ "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },
{ "key": "Permissions-Policy", "value": "geolocation=(), microphone=(), camera=(), payment=()" }
]
}]
}
4. Verify deployment — curl -I https://your-app.example.com
5. Monitor logs — check for errors in first 5 minutes
6. Rollback if needed — revert to previous version
Example
// config — deploy-hsts
const config = require("./config");
# Submit to HSTS preload list
# 1. Ensure HSTS header with preload directive is set
# 2. Redirect HTTP to HTTPS on same domain
# 3. Submit at https://hstspreload.org
# Verify
curl -I https://example.com | grep -i strict-transport
Common Problems
- ⚠Can't access site after HSTS — browser cached HTTPS-only, clear HSTS in chrome://net-internals
- ⚠Subdomain issues — ensure includeSubDomains is intended
- ⚠Configuration drift between environments — use infrastructure-as-code (Terraform/Pulumi) to keep dev/staging/prod identical
Best Practices
- ✓Use max-age=63072000 (2 years) — standard for HSTS
- ✓Submit to preload list — built-in browser protection
- ✓Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit