---
schema_version: "1"
id: fccdd8ed7b2532de133a143d527dedffb775743ca7fc15265a6bcc7a84b5b369
title: HTTP Strict Transport Security (HSTS) for eCDN
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_manage_hsts.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_manage_hsts.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4bf0bacd929013fe286aaba461eff2c0edfe35e943887de9b1e47ab20c4cdfe3
description: HTTP Strict Transport Security (HSTS) secures your B2C Commerce site by instructing web browsers to access your domain using only HTTPS, which prevents downgrade attacks. You enable and disable HSTS per eCDN zone in Business Manager.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# HTTP Strict Transport Security (HSTS) for eCDN

HTTP Strict Transport Security (HSTS) secures your B2C Commerce site by instructing web browsers to access your domain using only HTTPS, which prevents downgrade attacks. You enable and disable HSTS per eCDN zone in Business Manager.

[Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US)

When HSTS is enabled, your site sends an HSTS header that tells web browsers to connect only over HTTPS. After a browser receives the header, it uses HTTPS for every later visit until the max age expires, which helps prevent downgrade attacks. Because the browser gets the header only after it connects, a shopper's first visit can still happen over HTTP. For extra security, you can enable preload. Major web browsers include a built-in list of domains, called the HSTS preload list, that they always open over HTTPS. Enabling preload is one step toward adding your domain to this list. After your domain is on the list, web browsers use HTTPS for your site from the first request.

All current major web browsers support HSTS. Details, such as how long a browser keeps HSTS settings in private browsing or how quickly it updates its preload list, vary by browser.

- **[Configure HSTS for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_hsts.htm&release=264.0.0&type=5)**  
    Enable HTTP Strict Transport Security (HSTS) for a B2C Commerce eCDN zone to make web browsers connect to your domain over HTTPS only. Set the max age, choose whether HSTS applies to subdomains, and optionally enable preload.
- **[Disable HSTS for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_disable_hsts.htm&release=264.0.0&type=5)**  
    Disabling HTTP Strict Transport Security (HSTS) for a B2C Commerce eCDN zone is a two-step process. You first let shoppers access your site over an insecure connection by setting the max age to 0, and then you stop your site from sending the HSTS header.