HSTS Config Builder

Configure HTTP Strict Transport Security. Set max-age, subdomains, and preload, with eligibility check for the HSTS preload list.

max-age: 31,536,000 seconds

includeSubDomains — apply HSTS to all subdomainspreload — submit to browser preload lists

Preload eligibility: ❌ Not eligible

• preload directive must be present

Header value

Strict-Transport-Security: max-age=31536000; includeSubDomains

Server config

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";