Handle BeginRequest event in Global.asax. This worked for me as rewrite module was absent on server. protected void Application_BeginRequest(object sender, EventArgs e) { switch (Request.Url.Scheme) { case "https": Response.AppendHeader("Strict-Transport-Security", "max-age=31536000"); break; case "http": var path = "https://" + Request.Url.Host + Request.Url.PathAndQuery; Response.Status = "301 Moved Permanently"; Response.AddHeader("Location", path); break; } }