Try It Yourself - SyntaxStudy Editor

HTML / CSS / JS

<?php
// Laravel middleware: enforce HSTS with progressive rollout

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class StrictTransportSecurity
{
    // Increase max-age as confidence grows:
    // Phase 1: 300  (5 min)  — initial testing
    // Phase 2: 86400         — one day
    // Phase 3: 2592000       — one month
    // Phase 4: 31536000      — one year + preload-eligible
    private const MAX_AGE = 31_536_000;

public function handle(Request $request, Closure $next): Response
    {
        $response = $next($request);

if ($request->secure()) {
            $response->headers->set(
                'Strict-Transport-Security',
                'max-age=' . self::MAX_AGE . '; includeSubDomains; preload'
            );
        }

return $response;
    }
}

// Register in bootstrap/app.php (Laravel 11+):
// ->withMiddleware(function (Middleware $middleware) {
//     $middleware->append(StrictTransportSecurity::class);
// })

// Verify with curl:
// curl -sI https://example.com | grep -i strict