Meet the HSTS preload requirements or remove preload on Netlify

Why it matters

Your header asks browsers to preload the domain but the site does not meet the rules of the preload list. The preload list is very hard to leave once you are on it, so do not submit until you are sure.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. If the header does not include includeSubDomains yet, first follow the includeSubDomains fix (max-age=300, check every subdomain); use the full value only after that.
2. Make the domain reachable on its www subdomain as well, then add the full header in _headers or netlify.toml and deploy. Netlify warns that the setting is hard to remove, so only do this once every subdomain is HTTPS-only.
3. Run the checker at hstspreload.org and fix what it reports before submitting the domain. Do not submit until every subdomain is certain to stay on HTTPS.

/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Consider submitting the domain to the HSTS preload list