Add the Strict-Transport-Security (HSTS) header on Netlify

Why it matters

Without HSTS, a browser that is sent to the http:// address first can be intercepted before it reaches the secure site. The header tells browsers to use HTTPS only, for as long as you specify.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Netlify sends Strict-Transport-Security with max-age=31536000 on its own, so a missing header means something in front of Netlify (a proxy or CDN) strips it, or a rule of yours removes it. Check with curl -sI https://example.com/ and look for such a layer first.
2. To set it yourself, add a _headers file to the publish directory, or a headers block to netlify.toml, then deploy. Use only one of the two for the same path.
3. Raise max-age in the stages from the generic steps (86400, then 2592000, then 31536000).

/*
  Strict-Transport-Security: max-age=300

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list