Meet the HSTS preload requirements or remove preload

Why it matters

Your header asks browsers to preload the domain but the site does not meet the rules of the preload list. The preload list is very hard to leave once you are on it, so do not submit until you are sure.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. Decide whether you want preload at all. It makes browsers use HTTPS for the whole domain and every subdomain from the first visit, and removing it takes months because it ships with browser updates.
2. If you do not want that commitment, remove the preload directive from the header.
3. If you do, meet every requirement and fix what the checker at hstspreload.org reports. It needs a valid certificate, an http:// to https:// redirect on the same host, HTTPS on all subdomains, and the header on the base domain with max-age of at least 31536000, includeSubDomains and preload. The header must also appear on redirect responses.
4. Test every subdomain over HTTPS before adding includeSubDomains, and raise max-age in stages.
5. Do not submit the domain until the checker passes and you are sure all subdomains will keep HTTPS.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Consider submitting the domain to the HSTS preload list