---
schema_version: "1"
id: b0adcaf8c660c8d407260a91e78bfedbf9efc842a85e5139890b6537d16af08c
title: Set HSTS for Business Manager in Global Preferences
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_configure_hsts_for_business_manager.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_configure_hsts_for_business_manager.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 22ac0f0914b2c8e0d539b148ed7edc8e538f78f040ad39978f37b5e8adef04e3
description: HTTP Strict Transport Security (HSTS) can substantially improve the security of the Business Manager for B2C Commerce. To secure Business Manager, HSTS instructs web browsers to access the domain using only HTTPS.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Set HSTS for Business Manager in Global Preferences

HTTP Strict Transport Security (HSTS) can substantially improve the security of the Business Manager for B2C Commerce. To secure Business Manager, HSTS instructs web browsers to access the domain using only HTTPS.

Web browsers check the Business Manager HTTP header for information on HSTS. When the web browser reads a max age for HSTS, the browser doesn't check the header again until the max age has expired. Because a web browser checks the header only after the max age has passed, you can't manually disable HSTS. Change the max age at any time. Update HSTS only on an HTTPS connection. Choosing Cease signals to the User Agent to stop regarding the host as a known HSTS Host.

1. In Business Manager, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Global Preferences** | **Security**.
2. Select Access Restriction.
3. Select Max-Age.
4. Review and accept the acknowledge message.
5. Select one of the pre-defined values.
6. Click **Apply**.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note Enabling HSTS requires this site to fully run HTTPS, having a valid certificate in place. Otherwise, your browser won't be able to access the site anymore. Therefore consider increasing the max-age setting in stages. For example, to make sure access to the instance works properly while having HSTS enabled, consider increasing the max-age value from five minutes, to one hour, to one day to 180 days or more.