HSTS with Apache

.htaccess

<IfModule mod_headers.c>
  # Remove any previously set header from the 'onsuccess' table.
  Header unset Strict-Transport-Security

  # Set the header in the 'always' table for HTTPS requests, replacing any previous header.
  Header always set Strict-Transport-Security "max-age=31536000; includeSubdomains" env=HTTPS

  # For HTTP requests, the header should not be sent.
  Header always unset Strict-Transport-Security env=!HTTPS
</IfModule>

<IfModule mod_rewrite.c>
  # Instead, send a 301 redirect.
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>