Re-enable HSTS (max-age is zero) on nginx

Why it matters

A max-age of zero tells browsers to forget HSTS, so the site is sending the header but gaining no protection from it. It is often left over from a rollback.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find the add_header line that sets max-age=0 (grep -R Strict-Transport-Security /etc/nginx) and change the value. Test with nginx -t and reload.
2. Raise max-age in the stages from the generic steps (86400, then 2592000, then 31536000), reloading and checking with curl -sI each time.

add_header Strict-Transport-Security "max-age=300" always;

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list