Meet the HSTS preload requirements or remove preload on Shopify
Why it matters
Your header asks browsers to preload the domain but the site does not meet the rules of the preload list. The preload list is very hard to leave once you are on it, so do not submit until you are sure.
Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.
The fix
Not possible on Shopify. Shopify sends the Strict-Transport-Security header of its stores itself and does not let stores change its directives, so a store cannot make itself eligible for the preload list. Set by Shopify: you can't change this.
Related
- Reported by the HSTS check
- Add the Strict-Transport-Security (HSTS) header
- Fix the malformed Strict-Transport-Security header
- Re-enable HSTS (max-age is zero)
- Raise the HSTS max-age
- Decide whether to add includeSubDomains
- Consider submitting the domain to the HSTS preload list
- Send HSTS on the redirect visitors meet first
Scan your domain to see whether this applies to you.