Tools

Enable HTTP Strict Transport Security in Serv-U

This article describes how to enable HTTP Strict Transport Security (HSTS) in Serv-U to pass security compliance.

First published date

5/6/2019 8:16 PM

Last published date

7/16/2025 5:10 PM

Overview

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only HTTPS connections, which provide Transport Layer Security (TLS/SSL), unlike the insecure HTTP protocol used alone. HSTS is an IETF standards track protocol and is specified in RFC 6797.

The HSTS Policy is communicated by the server to the user agent via an HTTPS response header field named "Strict-Transport-Security". HSTS Policy specifies a period of time during which the user agent should only access the server in a secure fashion. Websites using HSTS often do not accept clear text HTTP, either by rejecting connections over HTTP or systematically redirecting users to HTTPS (though this is not required by the spec). The consequence of this is a user-agent not capable of doing TLS will not be able to connect to the site anymore.

To enable HSTS, please follow the procedure below.

Product section

Serv-U Managed File Transfer & Serv-U FTP Server

Resolution

  1. Open Serv-U Management Console.
  2. Go to the Domain.
  3. Click Limits and Settings.
  4. Under limit type, select HTTP.
  5. Double-click Use HTTPS Strict Security.
  6. In the Serv-U dialog box, click Yes to continue.
  7. In the Limit dialog box, select Use HTTPS Strict Security, and then click Save.
    • Use HTTP Strict Transport Security now displays in the Limits tab. The entry is highlighted, indicating that it is active.

    • Note: You cannot change the default value of any limit in the Limits tab.