Fix the malformed Strict-Transport-Security header on nginx

Why it matters

The header is present but does not follow the required syntax, so browsers ignore it and your site gets no HSTS protection. A small typo such as a missing max-age is enough.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Search for the directive (grep -R Strict-Transport-Security /etc/nginx) and keep one correct line. Include the always parameter.
2. If the site uses proxy_pass or fastcgi_pass and the application also sends the header, add proxy_hide_header (or fastcgi_hide_header) so only nginx's value reaches visitors. Otherwise visitors get two headers.
3. Test with nginx -t and reload.

add_header Strict-Transport-Security "max-age=300" always;
# only with proxy_pass, when the application also sends the header:
# proxy_hide_header Strict-Transport-Security;

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list