How to enable HTTP Strict Transport Security (HSTS) in MDaemon for Webmail and Remote Administration

HTTP Strict Transport Security (HSTS) is available for MDaemon's Webmail and Remote Administration web servers. This feature will inform browsers to never connect to Webmail or Remote administration over HTTP.

Follow the steps below to enable HTTP Strict Transport Security (HSTS).

1. Login to Remote Administration as the Global Administrator.
2. Select Main
3. Select Webmail Settings
4. Select Web Server
5. Enter Strict-Transport-Security for the Header Name in the HTTP Response Headers section.
6. Enter the 'max-age' value and options in the Header Value section.
   
   • The max-age value is the number of seconds that the browser should remember the site should only access the site via HTTPS.
   • max-age=31536000 is a standard value.  31536000 seconds equals 12 months.
   • (optional) Add includeSubDomains to apply to the site's subdomains.
   • Example: max-age=31536000; includeSubDomains
7. Select Add
8. Enter UseHTTPStrictTransportSecurity for the Header Name in the HTTP Response Headers section.
9. Enter Yes for the header value.
10. Select Add

These steps can be replicated for Remote Administration.

1. Select Main
2. Select Remote Admin Settings
3. Select Web Server
4. Add the same headers and values for the Webmail settings under HTTP Response Headers.