PHPackages middlewares/https - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [HTTP & Networking](/categories/http) 4. / 5. middlewares/https ActiveLibrary[HTTP & Networking](/categories/http) middlewares/https ================= Middleware to redirect to https and adds the Strict-Transport-Security header v2.1.0(1y ago)1389.1k↓40%3[1 issues](https://github.com/middlewares/https/issues)3MITPHPPHP ^7.2 || ^8.0CI passing Since Oct 8Pushed 1y ago1 watchersCompare [ Source](https://github.com/middlewares/https)[ Packagist](https://packagist.org/packages/middlewares/https)[ Docs](https://github.com/middlewares/https)[ RSS](/packages/middlewares-https/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (10)Dependencies (8)Versions (15)Used By (3) middlewares/https ================= [](#middlewareshttps) [![Latest Version on Packagist](https://camo.githubusercontent.com/b1e564c6d67fe2561e7f2d035cee78eb0894d71adbe75f8e7cfd7b7bfc6923ab/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6d6964646c6577617265732f68747470732e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/middlewares/https)[![Software License](https://camo.githubusercontent.com/55c0218c8f8009f06ad4ddae837ddd05301481fcf0dff8e0ed9dadda8780713e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d627269676874677265656e2e7376673f7374796c653d666c61742d737175617265)](LICENSE)[![Testing](https://github.com/middlewares/https/workflows/testing/badge.svg)](https://github.com/middlewares/https/workflows/testing/badge.svg)[![Total Downloads](https://camo.githubusercontent.com/273906b4d2baf87c83de9780494ad191cb767e89b44bb1baf6203a116279552b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6d6964646c6577617265732f68747470732e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/middlewares/https) Middleware to redirect to `https` if the request is `http` and add the [Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) header to protect against protocol downgrade attacks and cookie hijacking. Requirements ------------ [](#requirements) - PHP >= 7.2 - A [PSR-7 http library](https://github.com/middlewares/awesome-psr15-middlewares#psr-7-implementations) - A [PSR-15 middleware dispatcher](https://github.com/middlewares/awesome-psr15-middlewares#dispatcher) Installation ------------ [](#installation) This package is installable and autoloadable via Composer as [middlewares/https](https://packagist.org/packages/middlewares/https). ``` composer require middlewares/https ``` Example ------- [](#example) ``` $dispatcher = new Dispatcher([ (new Middlewares\Https()) ->includeSubdomains() ]); $response = $dispatcher->dispatch(new ServerRequest()); ``` Usage ----- [](#usage) This middleware accept a `Psr\Http\Message\ResponseFactoryInterface` as a constructor argument, to create the redirect responses. If it's not defined, [Middleware\\Utils\\Factory](https://github.com/middlewares/utils#factory) will be used to detect it automatically. ``` $responseFactory = new MyOwnResponseFactory(); //Detect the response factory automatically $https = new Middlewares\Https(); //Use a specific factory $htts = new Middlewares\Https($responseFactory); ``` ### maxAge [](#maxage) This option allow to define the value of `max-age` directive for the `Strict-Transport-Security` header. By default is `31536000` (1 year). ``` $threeYears = 31536000 * 3; $https = (new Middlewares\Https())->maxAge($threeYears); ``` ### includeSubdomains [](#includesubdomains) By default, the `includeSubDomains` directive is not included in the `Strict-Transport-Security` header. Use this function to change this behavior. ``` $https = (new Middlewares\Https())->includeSubdomains(); ``` ### preload [](#preload) By default, the `preload` directive is not included in the `Strict-Transport-Security` header. Use this function to change this behavior. ``` $https = (new Middlewares\Https())->preload(); ``` ### checkHttpsForward [](#checkhttpsforward) Enabling this option ignore requests containing the header `X-Forwarded-Proto: https` or `X-Forwarded-Port: 443`. This is specially useful if the site is behind a https load balancer. ``` $https = (new Middlewares\Https())->checkHttpsForward(); ``` ### redirect [](#redirect) This option returns a redirection response from `http` to `https`. It's enabled by default. ``` //Disable redirections $https = (new Middlewares\Https())->redirect(false); ``` --- Please see [CHANGELOG](CHANGELOG.md) for more information about recent changes and [CONTRIBUTING](CONTRIBUTING.md) for contributing details. The MIT License (MIT). Please see [LICENSE](LICENSE) for more information. ### Health Score 48 — FairBetter than 95% of packages Maintenance44 Moderate activity, may be stable Popularity38 Limited adoption so far Community21 Small or concentrated contributor base Maturity76 Established project with proven stability Bus Factor1 Top contributor holds 92.3% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~237 days Recently: every ~585 days Total 14 Last Release 421d ago Major Versions v0.6.0 → v1.0.02018-01-26 v1.3.0 → v2.0.02020-09-25 PHP version history (4 changes)v0.1.0PHP ^5.6 || ^7.0 v0.6.0PHP ^7.0 v2.0.0PHP ^7.2 v2.0.1PHP ^7.2 || ^8.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/e99df56b617f4af8cf0556a51a0ca20c7420104920c57d7e9eab093f92bb744f?d=identicon)[oscarotero](/maintainers/oscarotero) ![](https://www.gravatar.com/avatar/42e0d72f42eb7d84f67e20d28606da42e5a3248ca908b1eadb4366aafeae2561?d=identicon)[filisko](/maintainers/filisko) --- Top Contributors [![oscarotero](https://avatars.githubusercontent.com/u/377873?v=4)](https://github.com/oscarotero "oscarotero (60 commits)")[![filisko](https://avatars.githubusercontent.com/u/8798694?v=4)](https://github.com/filisko "filisko (2 commits)")[![cseufert](https://avatars.githubusercontent.com/u/1734519?v=4)](https://github.com/cseufert "cseufert (1 commits)")[![RBogie](https://avatars.githubusercontent.com/u/4340484?v=4)](https://github.com/RBogie "RBogie (1 commits)")[![WyriHaximus](https://avatars.githubusercontent.com/u/147145?v=4)](https://github.com/WyriHaximus "WyriHaximus (1 commits)") --- Tags hstshttphttpsmiddlewarepsr-15httppsr-7httpsmiddlewarepsr-15strict transport security ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StylePHP CS Fixer Type Coverage Yes ### Embed Badge ![Health badge](/badges/middlewares-https/health.svg) ``` [![Health](https://phpackages.com/badges/middlewares-https/health.svg)](https://phpackages.com/packages/middlewares-https) ``` ### Alternatives [middlewares/request-handler Middleware to execute request handlers 451.6M26](/packages/middlewares-request-handler)[middlewares/fast-route Middleware to use FastRoute 96191.1k15](/packages/middlewares-fast-route)[middlewares/negotiation Middleware to implement content negotiation 47442.1k11](/packages/middlewares-negotiation)[middlewares/trailing-slash Middleware to normalize the trailing slash of the uri path 32506.3k11](/packages/middlewares-trailing-slash)[middlewares/payload Middleware to parse the body of the request with support for json, csv and url-encode 32466.8k17](/packages/middlewares-payload)[middlewares/http-authentication Middleware to implement Basic and Digest Http authentication 35302.0k2](/packages/middlewares-http-authentication) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)