I'd like to add a HSTS header to our SharePoint 2013 Foundation on prem install, but can't seem to find a way to do this. I've seen a lot mention this in other questions -

$wa = Get-SPWebApplication https://sharepoint.example.com
$wa.HttpStrictTransportSecuritySettings.IsEnabled = $true

However, looking at this blog it shows that the object HttpStrictTransportSecuritySettings does not exist in SharePoint 2013.

Has anyone else using 2013 on prem had any success doing this?


You can enable it via the web.config in IIS as shown in How to enable HTTP Strict Transport Security (HSTS) in IIS7+. With that said, it may or may not break something -- 2016 and above are specifically tested with it.

| improve this answer | |
  • Thanks. I've added that to web.config, but I'm still getting the missing Strict-Transport-Security header in scans. The SSL Labs scan does pick it up though. How can one scan pick it up, but the rest don't? Surely something isn't right. – Steve G Mar 18 '19 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.