Send HSTS on the redirect visitors meet first on nginx

Why it matters

Visitors who type this name get a redirect first, to the host the site is served from or to another page of the same host. Without a Strict-Transport-Security header on that redirect, a visitor whose policy has expired can still be downgraded there, and the HSTS preload list reads the header on it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Add the header to the port 443 server block that answers example.com with the redirect. The always parameter sends it on redirect responses too.
2. Run nginx -t, reload, and check with curl -sI https://example.com/.

server {
    listen 443 ssl;
    server_name example.com;
    add_header Strict-Transport-Security "max-age=31536000" always;
    return 301 https://www.example.com$request_uri;
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list