Meet the HSTS preload requirements or remove preload on Vercel

Why it matters

Your header asks browsers to preload the domain but the site does not meet the rules of the preload list. The preload list is very hard to leave once you are on it, so do not submit until you are sure.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. If the header does not include includeSubDomains yet, first follow the includeSubDomains fix (max-age=300, check every subdomain); use the full value only after that.
2. Vercel redirects http to https at its edge. Set the full header in vercel.json for the base domain, then redeploy and run the hstspreload.org checker.
3. If example.com redirects to www in Vercel's Domains settings, its redirect carries only Vercel's default header, so the preload check can fail. Make example.com serve the site, or check another redirect method with curl -sI https://example.com/.
4. Run the checker at hstspreload.org and fix what it reports before submitting the domain. Do not submit until every subdomain is certain to stay on HTTPS.

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains; preload" }
      ]
    }
  ]
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Consider submitting the domain to the HSTS preload list