The Strict-Transport-Security header is sent from SPP version 6.0 and above.
Verification steps:
To check whether HSTS is enabled on your SPP appliance, verify that the HTTPS response includes
the Strict-Transport-security header
You can check the HSTS header with a header-only curl request to the SPP HTTPS endpoint on port
443, which is the appliance interface used for web and API access. For example, using command prompt, run the following Curl command:
curl -k -I https://{SPP-hostname-or-IP}/
Then look in the response for this line:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
If that header appears, HSTS is being sent successfully.
© 2026 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center