HSTS Missing From HTTPS Server

[danb35 (Dan)]

@stephdl

Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

Both the includeSubDomains and preload are dangerous options here; the first applies HSTS outside of the vhost where the header was added, and the second (eventually) puts you on the preload list such that if you ever do have a certificate problem, you really will never be able to access your site.

[stephdl (Stéphane de Labrusse)]

@danb35

puts you on the preload list such that if you ever do have a certificate problem, you really will never be able to access your site.

That is the concern

[danb35 (Dan)]

So mitigate it–don’t add the preload directive. It doesn’t need to be there, and at least right now, the common scanners don’t penalize for it not being there.