Raise the HSTS max-age

Why it matters

A short HSTS lifetime means browsers forget the HTTPS-only rule quickly, so visitors who return later are exposed again. A lifetime of at least six months, and ideally one year, keeps them protected.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Raise max-age in stages. If it is still a testing value (minutes or a day), go to 30 days (2592000) first and watch for problems for a week.
2. Then raise it to one year (31536000), which is the usual target and also the minimum for the preload list.
3. Keep includeSubDomains and preload for their own step, since each needs separate checks.
4. Check the header after each change with curl -sI.

Strict-Transport-Security: max-age=31536000

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list