The HTTP Strict Transport Security (HSTS) feature is a security policy mechanism that helps to protect against man-in-the-middle attacks by telling web browsers that they should use only HTTPS to connect.

The header is added to all HTTP responses on port 443, specifying a lifetime of one year. Optional properties can be set by adding multi-value property hstsFlags to the locked.properties file. The following values can be set.

Property Value
includeSubDomains Applies to all subdomains of this site.
preload Hint to include this site in HSTS preload lists.
Example:
hstsFlags.1=includeSubDomains
hstsFlags.2=preload
Note: These properties are not set by default because they can affect URLs outside of Horizon too. Do not set unless you understand the implications.