Strict-Transport-Security (HSTS) Preload Setup on Nginx

Prevent SSL Stripping and downgrade attacks by forcing browsers to connect via HTTPS exclusively with Chrome HSTS Preload eligibility.

1. Attack Signature & Impact Analysis

High (Man-in-the-Middle Hijack)

Without HSTS, the very first HTTP request before redirection can be intercepted by public Wi-Fi attackers (SSLstrip), stripping encryption and stealing session cookies.

2. Production Hardening Configuration (`/etc/nginx/conf.d/ssl-hsts.conf`)

Deploy this validated configuration to your production server or reverse proxy:

# Enforce HSTS Preload (2 years max-age, includes all subdomains)
server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    # Security Header for HSTS Preload List
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    
    # Prevent MIME type sniffing
    add_header X-Content-Type-Options "nosniff" always;
}

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Verify HSTS header presence
curl -s -D- https://yourdomain.com | grep -i strict-transport-security
# Submit domain to official Chrome/Firefox Preload List at https://hstspreload.org

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: WARNING: Once preloaded, every single subdomain (including internal dev/staging sites) MUST have valid SSL certificates, or users will be permanently blocked from accessing them.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: