# Enabling HTTP Strict Transport Security (HSTS)

> This article provides steps for configuring HSTS in Cascade CMS.

URL: https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/installation-and-upgrades/system-configuration/enabling-http-strict-transport-security-hsts.html
category: Cascade Administration
article-type: how-to
content-kind: article
release-availability: all
tags: security, installation
updated: 2026-10-06

## Overview

To enable HTTP Strict Transport Security (HSTS):

1. Stop Cascade CMS.
1. Edit the file `tomcat/conf/web.xml`.
1. Add the following just before the closing `</web-app>` tag:
    ```markup
    <filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
        <init-param>
          <param-name>hstsEnabled</param-name>
          <param-value>true</param-value>
        </init-param>
        <init-param>
          <param-name>hstsMaxAgeSeconds</param-name>
          <param-value>31536000</param-value>
        </init-param>
        <init-param>
          <param-name>hstsIncludeSubDomains</param-name>
          <param-value>true</param-value>
        </init-param>
        <init-param>
          <param-name>antiClickJackingOption</param-name>
          <param-value>SAMEORIGIN</param-value>
        </init-param>
      </filter>

      <filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
      </filter-mapping>
    ```

1. Save the file
1. Start Cascade CMS

See the official [Apache Tomcat documentation](https://tomcat.apache.org/tomcat-9.0-doc/config/filter.html#HTTP_Header_Security_Filter) for additional information.

> **Tip**
>
> Be sure to document any changes you make to the `web.xml` file so that you can put them back in place after any future upgrades to the application.