Send HSTS on the redirect visitors meet first on Caddy

Why it matters

Visitors who type this name get a redirect first, to the host the site is served from or to another page of the same host. Without a Strict-Transport-Security header on that redirect, a visitor whose policy has expired can still be downgraded there, and the HSTS preload list reads the header on it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Add a header directive to the site block that redirects example.com and reload Caddy.

example.com {
	header Strict-Transport-Security "max-age=31536000"
	redir https://www.example.com{uri} permanent
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list