Extract the module in your modules directory

Ex: sites/all/modules/contrib/hsts

Go to admin/modules and enable the HSTS module.

To enable the header, to go admin/config/security/hsts