Raise the HSTS max-age on Vercel

Why it matters

A short HSTS lifetime means browsers forget the HTTPS-only rule quickly, so visitors who return later are exposed again. A lifetime of at least six months, and ideally one year, keeps them protected.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Vercel sends a two-year max-age on custom domains by default. If yours is shorter, an explicit rule in vercel.json is overriding it, so raise the value there and redeploy.
2. Check with curl -sI https://example.com/ that the new value is sent, and watch for problems before any further increase.

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=31536000" }
      ]
    }
  ]
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list