HSTS（Strict Transport Security）

#Nginx 設定
server {
    listen 443 ssl http2;
    server_name example.com;
    # 啟用 HSTS（建議維持至少 1 年 = 31536000 秒）
    # includeSubDomains: 套用至所有子網域
    # preload: 允許加入瀏覽器預載清單
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}

#Apache2 設定
<VirtualHost *:443>
    ServerName example.com   
    # 啟用 HSTS
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</VirtualHost>

測試
chrome://net-internals/#hsts
curl -I https://127.0.0.1
Plaintext
HTTP/2 200
...
strict-transport-security: max-age=31536000; includeSubDomains; preload
...

Qualys SSL Labs（權威檢測）
網址：https://www.ssllabs.com/ssltest/

HSTS Preload 狀態檢查
網址：https://hstspreload.org/