Warning: Unnecessary HSTS header over HTTP

user_2365100 0
Viewed 6693

I want to use https:// and non www. URL always. So I used the following code in my htaccess file. But i am getting an warning from https://hstspreload.org

RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]    

<ifModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000;
includeSubDomains; preload" 
</ifModule>

Warning Message is given bellow :

Warning: Unnecessary HSTS header over HTTP
The HTTP page at http://mysiteurl.com sends an HSTS header. This has no effect over HTTP, and should be removed.

Please help me to rid the above warning. I tried with the following code also but it does not work #ref. topic 

 Header always set Strict-Transport-Security "max-age=31536000; 
 includeSubDomains; preload" env=HTTPS
hsts .htaccess
4 Answers

I solved the error in my litespeed based server by this method. Also works for apache. First add this code into your htaccess-

# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Then add this code-

<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" env=HTTPS
</IfModule>
user_162663660

Ubuntu 18.04 apache2 Letsencrytp

nano /etc/apache2/conf-enabled/ssl-params.conf

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" env=HTTPS

service apache2 restart

remove or comment # all other vhost conf on apache.conf with #Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" env=HTTPS

user_124715150
Related