Send HSTS on the redirect visitors meet first on Apache

Why it matters

Visitors who type this name get a redirect first, to the host the site is served from or to another page of the same host. Without a Strict-Transport-Security header on that redirect, a visitor whose policy has expired can still be downgraded there, and the HSTS preload list reads the header on it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Add the header to the VirtualHost on port 443 that redirects example.com. Header always set sends it on redirect responses too.
2. Run apachectl configtest, reload, and check with curl -sI https://example.com/.

<VirtualHost *:443>
    ServerName example.com
    Header always set Strict-Transport-Security "max-age=31536000"
    Redirect permanent / https://www.example.com/
</VirtualHost>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list