How to fix hsts max age too short on Headless / Custom (I build in code)

Steps for Headless / Custom (I build in code)

1. Set the header in your server framework or hosting platform — do not rely on meta tags (HSTS is a server-sent HTTP header only).
2. Next.js (next.config.js): module.exports = { async headers() { return [{ source: '/(.*)', headers: [{ key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' }] }] } }
3. Vercel (vercel.json): { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains" }] }] }
4. Netlify (_headers file in /public): /* Strict-Transport-Security: max-age=31536000; includeSubDomains
5. Cloudflare (Transform Rules): Dashboard → your domain → Rules → Transform Rules → Modify Response Header → Add rule: Header name = Strict-Transport-Security, Value = max-age=31536000; includeSubDomains. Apply to all HTTPS requests.
6. Nginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; inside the server block for port 443.
7. Express.js (Node): Use the 'helmet' npm package — helmet() sets HSTS to max-age=15552000 by default; override with: app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true }));

What is hsts max age too short?

HTTP Strict Transport Security (HSTS) is a security header your web server sends to browsers that says: "Only ever connect to this site over HTTPS — never plain HTTP." The `max-age` value inside that header tells the browser how many seconds to remember and enforce that rule. A value of 86400 means just one day — after 24 hours the browser forgets the instruction and could allow an unencrypted HTTP connection again. The industry standard is 31536000 (one full year), meaning the browser stays protected for 365 days after each visit.

A short max-age creates a real window of vulnerability every single day. If a visitor's browser cache expires and they visit your store over an insecure network (coffee shop Wi-Fi, hotel hotspot), an attacker can intercept that initial unencrypted HTTP request and steal login credentials, session cookies, or payment data — a classic SSL-stripping attack. Beyond security, Google has used HTTPS as a ranking signal since 2014 and continues to favor sites that implement it properly; a misconfigured HSTS header signals to security-aware crawlers and auditors that your HTTPS setup is incomplete. Short max-age values are also explicitly flagged by OWASP and browser preload-list requirements, and many enterprise buyers and compliance frameworks (PCI-DSS, SOC 2) require HSTS to be set correctly before approving a vendor.

See the complete Hsts max age too short guide for every platform and the full background.