Meet the HSTS preload requirements or remove preload on Caddy

Why it matters

Your header asks browsers to preload the domain but the site does not meet the rules of the preload list. The preload list is very hard to leave once you are on it, so do not submit until you are sure.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. If the header does not include includeSubDomains yet, first follow the includeSubDomains fix (max-age=300, check every subdomain); use the full value only after that.
2. Caddy redirects http to https by default. Add the header to the example.com block even when that block only redirects (for example to www). The www block in the snippet carries it too, which is good practice.
3. Run the checker at hstspreload.org and fix what it reports before submitting the domain. Do not submit until every subdomain is certain to stay on HTTPS.

example.com {
	header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
}

www.example.com {
	header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
	redir https://example.com{uri} permanent
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Consider submitting the domain to the HSTS preload list