http strict transport

Version: `v2023-05-30`	Includes use: No

Behavior name: HTTP Strict Transport Security (HSTS)

Applies HTTP Strict Transport Security (HSTS), disallowing insecure HTTP traffic. Apply this to hostnames managed with Standard TLS or Enhanced TLS certificates.

Default behavior

These samples reflect the behavior's default settings. You can use these as is in your configurations or make adjustments based on the behavior's available options.

data "akamai_property_rules_builder" "http_strict_transport_security" {
  rules_v2025_02_18 {
    name     = "HTTP Strict Transport Security (HSTS)"
    comments = "Applies HTTP Strict Transport Security (HSTS)."
    behavior {
      http_strict_transport_security {
        enable            = true
        maxAge            = "ONE_DAY"
        includeSubDomains = false
        preload           = false
        redirect          = false
      }
    }
  }
}

"behaviors": [
  {
  "name": "httpStrictTransportSecurity",
  "options": {
    "enable": true,
    "maxAge": "ONE_DAY",
    "includeSubDomains": false,
    "preload": false,
    "redirect": false
    }
  }
]

Options

Option	Description
`enable`	Boolean Applies HSTS to this set of requests.
`max_age`	Enum Specifies the duration for which to apply HSTS for new browser connections. Value is one of: `ZERO_MINS`. This effectively disables HSTS, without affecting any existing browser connections. `TEN_MINS`. 10 minutes. `ONE_DAY`. 1 day. `ONE_MONTH`. 1 month. `THREE_MONTHS`. 3 months. `SIX_MONTHS`. 6 months. `ONE_YEAR`. 1 year. `TWO_YEARS`. 2 years.
`include_sub_domains`	Boolean \| Requires: `max_age` isn't `ZERO_MINS` When enabled, applies HSTS to all subdomains.
`preload`	Boolean \| Requires: `max_age` isn't `ZERO_MINS` When enabled, adds this domain to the browser's preload list. You still need to declare the domain at hstspreload.org.
`redirect`	Boolean \| Requires: `max_age` isn't `ZERO_MINS` When enabled, redirects all HTTP requests to HTTPS.
`redirect_status_code`	Enum \| Requires Requires both: `max_age` isn't `ZERO_MINS` `redirect` is `true` Specifies a response code. Value is one of: `301` `302`