--- title: Configure HSTS description: Establish an HTTP Secure Transport Header (HSTS); so as to inform the Web-Console browser never to load a site using HTTP; and instead, to automatically convert all access-requests from HTTP to HTTPS. pubDate: 2026-08-17T09:53:44.266Z antora: editUrl: https://github.com/couchbase/docs-server/edit/release/8.0/modules/rest-api/pages/rest-setting-hsts.adoc xref: xref:server:rest-api:rest-setting-hsts.adoc[] --- [Consult the llms.txt file for a full list of contents](/llms.txt) [View original HTML](/server/current/rest-api/rest-setting-hsts.html) # Configure HSTS > Establish an HTTP Secure Transport Header (HSTS); so as to inform the Web-Console browser never to load a site using HTTP; and instead, to automatically convert all access-requests from HTTP to HTTPS. ## [](#http-method-and-uri)HTTP Method and URI GET /settings/security/responseHeaders POST /settings/security/responseHeaders DELETE /settings/security/responseHeaders ## [](#description)Description Establishes an _HTTP Secure Transport Header (HSTS)_; so as to inform the Web-Console browser never to load a site using HTTP; and instead, to automatically convert all access-requests from HTTP to HTTPS. Only the _Strict-Transport-Security_ header is supported. Three _sub-settings_ must be established, which are: * The duration of HTTPS-enforcement for this browser. * Whether the site's subdomains are to be covered by the setting. * Whether the _preload_ directive should be set; so that the policy is enforced before any communication takes place. ## [](#curl-syntax)Curl Syntax curl -X GET -u : http://:8091/settings/security/responseHeaders curl -X POST -u : http://:8091/settings/security/responseHeaders -d curl -X DELETE -u : http://:8091/settings/security/responseHeaders The `transport-security-specification` specified with POST must be JSON object that takes the following form: { Strict-Transport-Security: max-age=;[includeSubDomains];[preload] } The value specified for the `Strict-Transport-Security` key is a valid HSTS header, which will be used by the browser. The `integer` specified for `max-age` determines the number of seconds for which HTTPS is mandated for this browser. The optional `includeSubDomains` keyword, if specified, determines that all the subdomains for this site are to be covered by the specification. The optional `preload` keyword, if specified, determines that the specification is to be _preloaded_, to ensure that it becomes active even before any subsequent communication is attempted. ## [](#responses)Responses The `GET` method, if successful, gives `200 OK`. If a setting has been made, an object containing the valid header is returned. If no setting has been made, an empty array is returned. The `POST` method, if successful, gives `200 OK`, and returns an empty array. The `DELETE` method, if successful, also gives `200 OK`, and returns an empty array. For both methods, an incorrect URI gives `404 Object Not Found`, with a `Not found` error message. Use of improper credentials gives `401 Unauthorized`. An improper port number returns an error message such as `Failed to connect to localhost port 8094: Connection refused`. For the `POST` method, incorrectly specified parameters fail with `400 Bad Request`, and return an object such as the following: `{"errors":["responseHeaders - Invalid format. Expecting a json."]}`. ## [](#examples)Examples The methods and the URI can be used as shown below. ### [](#establish-hsts)Establish HSTS The following call establishes a _Strict-Transport-Security_ heading for the browser: curl -v -X POST localhost:8091/settings/security/responseHeaders \ -u Administrator:password \ -d '{"Strict-Transport-Security":"max-age=31536000;includeSubDomains;preload"}' This establishes that only HTTPS connections are accepted by this browser, and that this covers all subdomains for this site: it also specifies that this security constraint should be _preloaded_, so that it will be enforced even before any subsequent connection is attempted. The integer that is the value of `max-age` specifies the number of seconds during which the constraint should be maintained: this constitutes _one year_. The following, alternative call establishes a different header: curl -v -X POST localhost:8091/settings/security/responseHeaders \ -u Administrator:password \ -d '{"Strict-Transport-Security":"max-age=31536000"}' This again specifies that only HTTPS connections are accepted for the next year. However, the setting does not cover subdomains, and will not be preloaded. #### [](#get-the-current-hsts-setting)Get the Current HSTS Setting The following call returns the current HSTS setting, if one has indeed been established: curl -v -GET localhost:8091/settings/security/responseHeaders \ -u Administrator:password If no setting has been established, an empty array is returned. Otherwise, an object containing the setting is returned. For example: {"Strict-Transport-Security":"max-age=31536000"} #### [](#delete-the-current-hsts-setting)Delete the Current HSTS Setting The following call deletes the current HSTS setting, if one exists. curl -v -X DELETE localhost:8091/settings/security/responseHeaders \ -u Administrator:password The call always returns an empty array. ## [](#see-also)See Also For more information on managing on-the-wire security-settings with the REST API, see [Configure On-the-Wire Security](rest-setting-security.md). A conceptual overview of on-the-wire security is provided in [On-the-Wire Security](../learn/security/on-the-wire-security.md).