Consider submitting the domain to the HSTS preload list on Shopify
Why it matters
HSTS protects visitors only after their first secure visit, while the preload list covers the very first one as well. It is optional and hard to undo, so only do it when you are sure about HTTPS on the whole domain.
Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.
The fix
Not possible on Shopify. Shopify sends the Strict-Transport-Security header of its stores itself and does not let stores add the preload directive. Set by Shopify: you can't change this.
Related
- Reported by the HSTS check
- Add the Strict-Transport-Security (HSTS) header
- Fix the malformed Strict-Transport-Security header
- Re-enable HSTS (max-age is zero)
- Raise the HSTS max-age
- Decide whether to add includeSubDomains
- Meet the HSTS preload requirements or remove preload
- Send HSTS on the redirect visitors meet first
Scan your domain to see whether this applies to you.