Fix the malformed Strict-Transport-Security header on Caddy

Why it matters

The header is present but does not follow the required syntax, so browsers ignore it and your site gets no HSTS protection. A small typo such as a missing max-age is enough.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Search the Caddyfile for Strict-Transport-Security and keep one line. Use the header directive with a leading > so it replaces any value an upstream application sends, instead of adding a second one.
2. Check with curl -sI that exactly one Strict-Transport-Security header is sent, then raise max-age in stages (86400, then 2592000, then 31536000).

example.com {
	header >Strict-Transport-Security "max-age=300"
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list