---
schema_version: "1"
id: 49d7971601a36a0c9d0100c7390c5fa6d1ab4ca693a156e24c8bece886af047f
title: Configure HSTS for an eCDN Zone
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_configure_hsts.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_configure_hsts.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1892112a1ab15083a4d1150bb500b49a5993a9793778cf96e49d38a7c6bf8190
description: Enable HTTP Strict Transport Security (HSTS) for a B2C Commerce eCDN zone to make web browsers connect to your domain over HTTPS only. Set the max age, choose whether HSTS applies to subdomains, and optionally enable preload.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Configure HSTS for an eCDN Zone

Enable HTTP Strict Transport Security (HSTS) for a B2C Commerce eCDN zone to make web browsers connect to your domain over HTTPS only. Set the max age, choose whether HSTS applies to subdomains, and optionally enable preload.

[Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US)

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note HSTS isn't available on SCAPI zones. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required.").

Before you enable HSTS, make sure your site is fully HTTPS-ready. Because of how the max age works, you can't simply switch HSTS off later. For details, see [HTTP Strict Transport Security (HSTS) for eCDN](https://help.salesforce.com/s/articleView?id=cc.b2c_manage_hsts.htm&release=264.0.0&type=5 "HTTP Strict Transport Security (HSTS) secures your B2C Commerce site by instructing web browsers to access your domain using only HTTPS, which prevents downgrade attacks. You enable and disable HSTS per eCDN zone in Business Manager.").

![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_warning.png)

Warning If your site contains insecure content and HSTS is enabled, that content doesn't display in your shoppers' web browsers, potentially making your site impossible to view. To test your site, enable HSTS for short periods, starting with a few seconds and then longer.

1. To enable the HSTS option, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Global Preferences** | **Feature Switches** and enable **HSTS settings for eCDN zones**.
2. Select **Administration** | **Sites** | **Embedded CDN Settings**.
3. Locate your zone and select **Configure Zone** from the dropdown menu.
4. On the Crypto tab, click **Enable**.
    
    HSTS isn't active on your site until you set a max age and click **Apply**. Before you proceed, review the confirmation dialog text: "Enable HSTS for this zone? Make sure your site is fully HTTPS-ready before continuing."
5. Set the max age.
6. Select whether HSTS applies to subdomains.
7. Select whether to enable preload.
    
    Although there are several steps to officially register your site for preloading, some web browsers enable preload once they've received the preload tag in the header. Enable preload only after your entire site is secure. Preload can take up to a month to disable.
8. Click **Apply**.