Meet the HSTS preload requirements or remove preload on Cloudflare

Why it matters

Your header asks browsers to preload the domain but the site does not meet the rules of the preload list. The preload list is very hard to leave once you are on it, so do not submit until you are sure.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. If the header does not include includeSubDomains yet, first follow the includeSubDomains fix (max-age=300, check every subdomain); use the full value only after that.
2. Open SSL/TLS then Edge Certificates then HSTS. Switch on HSTS, set Max Age to 12 months, switch on Apply HSTS policy to subdomains and switch on Preload. Cloudflare requires a 12-month max-age for preload.
3. Also switch on Always Use HTTPS so http:// redirects to https://.
4. Check hstspreload.org, and submit only when you are sure every subdomain will keep HTTPS.
5. Never move records to DNS only, pause Cloudflare or disable SSL while HSTS is on.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Consider submitting the domain to the HSTS preload list