# Setting up HSTS header

**URL:** <https://forum.pritunl.com/t/setting-up-hsts-header/1856>\
**Category:** Pritunl VPN\
**Tags:** pritunl\
**Created:** [February 27, 2024, 9:23am UTC](https://forum.pritunl.com/t/setting-up-hsts-header/1856 "2024-02-27T09:23:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hendro](https://forum.pritunl.com/user_avatar/forum.pritunl.com/hendro/32/218_2.png) [@hendro](https://forum.pritunl.com/u/hendro)\
**Post date:** [February 27, 2024, 9:23am UTC](https://forum.pritunl.com/t/setting-up-hsts-header/1856/1 "2024-02-27T09:23:56Z")

</div>

How do I set HSTS header on pritunl server, similar to this one on OpenVPN AS?

> **[Access Server: How do I set HTTP Strict Transport Security (HSTS) on Access...](https://support.openvpn.com/hc/en-us/articles/21315655527835-Access-Server-How-do-I-set-HTTP-Strict-Transport-Security-HSTS-on-Access-Server)**
>
> Description: ​Access Server doesn't set the HTTP Strict Transport Security (HSTS) header by default because it doesn't serve the Client or Admin Web UIs over plain (unencrypted) HTTP. It's also unn...

Appreciate for any hints.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [February 28, 2024, 11:13pm UTC](https://forum.pritunl.com/t/setting-up-hsts-header/1856/2 "2024-02-28T23:13:14Z")

</div>

The header is set to `max-age=31536000; includeSubDomains`.

---

<div class="post-metadata">

**Author:** ![hendro](https://forum.pritunl.com/user_avatar/forum.pritunl.com/hendro/32/218_2.png) [@hendro](https://forum.pritunl.com/u/hendro)\
**Post date:** [February 29, 2024, 12:56am UTC](https://forum.pritunl.com/t/setting-up-hsts-header/1856/3 "2024-02-29T00:56:58Z")

</div>

Zach,  
Bear with me but how to set that custom header in pritunl ?..in the case of OpenVPN AS it is using the sacli command…what is the equivalent of:

> > > sacli --key “cs.http\_headers.0” --value “Strict-Transport-Security: max-age=63072000” ConfigPut ???

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [February 29, 2024, 7:39am UTC](https://forum.pritunl.com/t/setting-up-hsts-header/1856/4 "2024-02-29T07:39:14Z")

</div>

It’s set in [**pritunl/app.py**](https://github.com/pritunl/pritunl/blob/master/pritunl/app.py#L136) there is no option to change the header.

---

<div class="post-metadata">

**Author:** ![hendro](https://forum.pritunl.com/user_avatar/forum.pritunl.com/hendro/32/218_2.png) [@hendro](https://forum.pritunl.com/u/hendro)\
**Post date:** [February 29, 2024, 10:37am UTC](https://forum.pritunl.com/t/setting-up-hsts-header/1856/5 "2024-02-29T10:37:06Z")

</div>

Thanks…I’ll look into it…