--- title: Configure HSTS description: Establish an HTTP Secure Transport Header (HSTS); so as to inform the Web-Console browser never to load a site using HTTP; and instead, to automatically convert all access-requests from HTTP to HTTPS. pubDate: 2026-10-19T14:21:08.937Z meta: component: title: Operational Insights Enterprise version: "3.0" topic_type: reference antora: editUrl: https://github.com/couchbaselabs/docs-enterprise-analytics/edit/release/3.0/modules/reference/pages/rest-setting-hsts.adoc xref: xref:enterprise-analytics:reference:rest-setting-hsts.adoc[] --- [Consult the llms.txt file for a full list of contents](/llms.txt) [View original HTML](/operational-insights/current/reference/rest-setting-hsts.html) # Configure HSTS > Establish an HTTP Secure Transport Header (HSTS); so as to inform the Web-Console browser never to load a site using HTTP; and instead, to automatically convert all access-requests from HTTP to HTTPS. ## [](#http-method-and-uri)HTTP Method and URI GET /settings/security/responseHeaders POST /settings/security/responseHeaders DELETE /settings/security/responseHeaders ## [](#description)Description Establishes an _HTTP Secure Transport Header (HSTS)_; so as to inform the Web-Console browser never to load a site using HTTP; and instead, to automatically convert all access-requests from HTTP to HTTPS. Only the _Strict-Transport-Security_ header is supported. Three _sub-settings_ can be established, which are: * The duration of HTTPS-enforcement for this browser. This sub-setting is required. * Whether the site's subdomains are to be covered by the setting. * Whether the _preload_ directive should be set; so that the policy is enforced before any communication takes place. The caller must have the Full Admin or Security Admin role. ## [](#curl-syntax)Curl Syntax curl -X GET -u : http://:8091/settings/security/responseHeaders curl -X POST -u : http://:8091/settings/security/responseHeaders -d curl -X DELETE -u : http://:8091/settings/security/responseHeaders The `transport-security-specification` specified with POST must be a JSON object that takes the following form: { "Strict-Transport-Security": "max-age=[;includeSubDomains][;preload]" } The value specified for the `Strict-Transport-Security` key is a valid HSTS header, which will be used by the browser. The `integer` specified for `max-age` determines the number of seconds for which HTTPS is mandated for this browser. It must be a non-negative integer, and the `max-age` directive must be present. The optional `includeSubDomains` keyword, if specified, determines that all the subdomains for this site are to be covered by the specification. The optional `preload` keyword, if specified, determines that the specification is to be _preloaded_, to ensure that it becomes active even before any subsequent communication is attempted. Each directive can be specified only once. ## [](#responses)Responses The `GET` method, if successful, gives `200 OK`. If a setting has been made, an object containing the valid header is returned. If no setting has been made, an empty array is returned. The `POST` method, if successful, gives `200 OK`, and returns an empty array. The `DELETE` method, if successful, also gives `200 OK`, and returns an empty array. For all methods, an incorrect URI gives `404 Object Not Found`, with a `Not found` error message. Use of improper credentials gives `401 Unauthorized`. An improper port number returns an error message such as `Failed to connect to localhost port 8094: Connection refused`. For the `POST` method, incorrectly specified parameters fail with `400 Bad Request`, and return an object such as the following: `{"errors":["responseHeaders - Invalid format. Expecting a json."]}`. A header other than `Strict-Transport-Security` is rejected with the message `Only "Strict-Transport-Security" header allowed`; and a value without a `max-age` directive is rejected with the message `max-age directive is required`. ## [](#examples)Examples The methods and the URI can be used as shown below. ### [](#establish-hsts)Establish HSTS The following call establishes a _Strict-Transport-Security_ heading for the browser: curl -v -X POST localhost:8091/settings/security/responseHeaders \ -u Administrator:password \ -d '{"Strict-Transport-Security":"max-age=31536000;includeSubDomains;preload"}' This establishes that only HTTPS connections are accepted by this browser, and that this covers all subdomains for this site: it also specifies that this security constraint should be _preloaded_, so that it will be enforced even before any subsequent connection is attempted. The integer that is the value of `max-age` specifies the number of seconds during which the constraint should be maintained: this constitutes _one year_. The following, alternative call establishes a different header: curl -v -X POST localhost:8091/settings/security/responseHeaders \ -u Administrator:password \ -d '{"Strict-Transport-Security":"max-age=31536000"}' This again specifies that only HTTPS connections are accepted for the next year. However, the setting does not cover subdomains, and will not be preloaded. ### [](#get-the-current-hsts-setting)Get the Current HSTS Setting The following call returns the current HSTS setting, if one has indeed been established: curl -v -X GET localhost:8091/settings/security/responseHeaders \ -u Administrator:password If no setting has been established, an empty array is returned. Otherwise, an object containing the setting is returned. For example: {"Strict-Transport-Security":"max-age=31536000"} ### [](#delete-the-current-hsts-setting)Delete the Current HSTS Setting The following call deletes the current HSTS setting, if one exists. curl -v -X DELETE localhost:8091/settings/security/responseHeaders \ -u Administrator:password If successful, the call returns an empty array. ## [](#see-also)See Also For more information on managing on-the-wire security-settings with the REST API, see [Configure On-the-Wire Security](rest-setting-security.md). For an overview of on-the-wire security, see [Manage On-the-Wire Security](../manage/manage-security/manage-tls.md).