Meet the HSTS preload requirements or remove preload on Apache

Why it matters

Your header asks browsers to preload the domain but the site does not meet the rules of the preload list. The preload list is very hard to leave once you are on it, so do not submit until you are sure.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. If the header does not include includeSubDomains yet, first follow the includeSubDomains fix (max-age=300, check every subdomain); use the full value only after that.
2. Redirect http to https on the same host first, and send the full header on every HTTPS response of example.com, including its redirect to www if it has one. In this snippet example.com serves the site and www redirects to it; if it is the other way round, the redirecting example.com VirtualHost needs the Header line. Use Header always set everywhere, never a plain Header set elsewhere.
3. SSL lines are omitted from the snippet. Keep the ones you already have.
4. Run apachectl configtest and reload.

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

<VirtualHost *:80>
    ServerName www.example.com
    Redirect permanent / https://www.example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    # SSLEngine, SSLCertificateFile and SSLCertificateKeyFile as usual
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</VirtualHost>

<VirtualHost *:443>
    ServerName www.example.com
    # SSLEngine, SSLCertificateFile and SSLCertificateKeyFile as usual
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Redirect permanent / https://example.com/
</VirtualHost>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Consider submitting the domain to the HSTS preload list