Technical Tip: Enable and verify the HSTS header response feature in FortiWeb

In FortiWeb older legacy firmware versions, the HSTS header feature would return the HSTS response header to the users in the normal webpage only but not the FortiWeb attack blocking page. The issue was resolved in v7.0.1, whereby the HSTS header feature shall also add the HSTS response header to the attack blocking page (HTTP return code 500).

1. To check if the HSTS header is enabled in Server Policy, navigate to the Advanced SSL settings in the Server Policy editor page.

2. Simulate a web attack request to the Server Policy hostname and check for the response header.

3. The HSTS header response is only made available for normal website pages and the attack block page (HTTP return code 500); it is not available for the Server Unavailable page (HTTP return code 503).

Related document: