code: public static void setStrictTransportSecurity (@Nonnegative final int nMaxAgeSeconds,
                                                   final boolean bIncludeSubdomains)
    {
      setResponseHeader (CHttpHeader.STRICT_TRANSPORT_SECURITY,
                         new CacheControlBuilder ().setMaxAgeSeconds (nMaxAgeSeconds).getAsHTTPHeaderValue () +
                                                                (bIncludeSubdomains ? ";" +
                                                                                      CHttpHeader.VALUE_INCLUDE_SUBDOMAINS
                                                                                    : ""));
    }
docs: HTTP Strict Transport Security (HSTS) is an opt-in security enhancement that
  is specified by a web application through the use of a special response
  header. Once a supported browser receives this header that browser will
  prevent any communications from being sent over HTTP to the specified domain
  and will instead send all communications over HTTPS. It also prevents HTTPS
  click through prompts on browsers. The specification has been released and
  published end of 2012 as RFC 6797 (HTTP Strict Transport Security (HSTS)) by
  the IETF.
  
  @param nMaxAgeSeconds
  number of seconds, after the reception of the STS header field, during
  which the UA regards the host (from whom the message was received) as
  a Known HSTS Host.
  @param bIncludeSubdomains
  if enabled, this signals the UA that the HSTS Policy applies to this
  HSTS Host as well as any sub-domains of the host's domain name.