webzod
account

Meet the HSTS preload requirements or remove preload on nginx

tls.hsts.preload_not_eligible · effort: a project

Why it matters

Your header asks browsers to preload the domain but the site does not meet the rules of the preload list. The preload list is very hard to leave once you are on it, so do not submit until you are sure.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

  1. If the header does not include includeSubDomains yet, first follow the includeSubDomains fix (max-age=300, check every subdomain); use the full value only after that.
  2. Redirect http to https on the same host first, and send the full header on every HTTPS response of example.com, including its redirect to www if it has one. In this snippet example.com serves the site and www redirects to it; the header on the www block is good practice but the preload rule applies to example.com.
  3. Certificate lines are omitted from the snippet. Keep the ones you already have.
  4. Test with nginx -t and reload.
/etc/nginx/conf.d/site.conf 
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com;
    # ssl_certificate and ssl_certificate_key as usual
    # if example.com only redirects to www instead, keep this line in that redirecting block
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}

server {
    listen 443 ssl;
    server_name www.example.com;
    # ssl_certificate and ssl_certificate_key as usual
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    return 301 https://example.com$request_uri;
}

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.