Add the Strict-Transport-Security (HSTS) header on Vercel

Why it matters

Without HSTS, a browser that is sent to the http:// address first can be intercepted before it reaches the secure site. The header tells browsers to use HTTPS only, for as long as you specify.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Vercel is HTTPS-only and sends Strict-Transport-Security with a max-age of two years on custom domains by default, so a missing header means this host is not served directly by Vercel (a proxy in front may strip it) or the project overrides it.
2. To set it explicitly, add a headers rule to vercel.json and redeploy. Start with the short value, then raise it.

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=300" }
      ]
    }
  ]
}

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list