Raise the HSTS max-age on Shopify
Why it matters
A short HSTS lifetime means browsers forget the HTTPS-only rule quickly, so visitors who return later are exposed again. A lifetime of at least six months, and ideally one year, keeps them protected.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify sends the Strict-Transport-Security header of its stores itself and does not let stores change its max-age. Set by Shopify: you can't change this. Contact Shopify Support if you need a longer policy.
Related
- Reported by the HSTS check
- Add the Strict-Transport-Security (HSTS) header
- Fix the malformed Strict-Transport-Security header
- Re-enable HSTS (max-age is zero)
- Decide whether to add includeSubDomains
- Meet the HSTS preload requirements or remove preload
- Consider submitting the domain to the HSTS preload list
- Send HSTS on the redirect visitors meet first
Scan your domain to see whether this applies to you.