Home / server / Questions / 1021500
Accepted
oucil
Asked: 2020-06-16 04:52:44 +0800 CST

How can I apply HSTS header to all vhosts over 443 in Apache

  • 772

I'm looking to add the HSTS header in Apache...

# HSTS / Header Strict Transport Security
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

... but I have a long list of vhosts for different but related sites/sub-sites. I'd rather not have to define it in every one of my vhost definitions, but I'm not aware of a way to include a setting in the main https.conf that ONLY applies to the 443 / https versions of those vhosts since it raises warnings in validators when you apply HSTS to a standard 80 / http site.

I've tried wrapping it in <IfModule mod_ssl.c>...</IfModule> tags but if I'm not mistaken, this is really just asking Is the SSL module loaded? I tried searching lots of different ways, but when you don't know the term your looking for, it's difficult to sort through all the static. Any suggestions? Thanks!

https httpd.conf apache-2.4 http-headers hsts

1 Answers

  1. Best Answer

    You can do this with the <If> Directive and the Expressions available; request related variables:

    • REQUEST_SCHEME: The scheme part of the request's URI

      <If "%{REQUEST_SCHEME} == 'https'">
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
</If>

    • HTTPS: on if the request uses https, off otherwise

      <If "%{HTTPS} == 'on'">
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
</If>
    • 2