Send HSTS on the redirect visitors meet first

Why it matters

Visitors who type this name get a redirect first, to the host the site is served from or to another page of the same host. Without a Strict-Transport-Security header on that redirect, a visitor whose policy has expired can still be downgraded there, and the HSTS preload list reads the header on it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1, make sure https://example.com/ answers with a redirect over HTTPS. The snippets below redirect to www.example.com; keep the target your site actually redirects to (another host, or a path such as /home on the same host).
2. Stage 2, send the same Strict-Transport-Security header on the https://example.com/ redirect as the page it redirects to sends, starting with a short max-age and raising it in steps up to one year. Browsers ignore the header over plain http://, so add it to the HTTPS listener only.
3. Check it with curl -sI https://example.com/ and look for the header on the redirect response.

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/
Strict-Transport-Security: max-age=31536000

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list