Hi all, for our current self hosted Discourse instances, we need to add “IncludeSubDomains” to our STS headers due to this being an expectation of our internal scanners. Previously I achieved this by using some sed commands in app.yml in custom commands after build to update /etc/nginx/conf.d/discourse.confto include 'add_header Strict-Transport-Security “max-age=31536000; includeSubDomains” always; as well as: - replace: filename: "/etc/nginx/conf.d/outlets/discourse/20-https.conf" from: /add_header Strict-Transport-Security.+/ to: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; global: true - replace: filename: "/etc/nginx/conf.d/outlets/server/20-https.conf" from: /add_header Strict-Transport-Security.+/ to: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; global: true This previously worked. However, this has stopped working. I read that creating a new outlet file should allow me to add this using: hooks: after_code: - file: path: /etc/nginx/conf.d/outlets/server/90-hsts.conf chmod: 444 contents: | add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; However, this ends up in there being two STS headers present (one from the SSL template and one from my new template). Is there a better way of doing this so I don’t end up with two STS headers? I would have thought that nginx would respect the last header added, and ignore the SSL template header which just contains max-age=31536000; , so is this a defect? Thanks for any guidance you can provide.

[صورة] supermathie: The easiest option is probably editing templates/web.ssl.template.yml with the new values you want. I would do that first since it’s easiest. Once you figure it out, the next easiest thing is to copy that file somewhere else so that you don’t have issues with git conflicting with it. The best solution would be to combine your current strategy with another line to remove the other conflicting setting.

[صورة] tanya_byrne: add_header Does using set_header instead of add_header solve the problem?

I’ll give this a go and report back :slight_smile:

If I use set_header I get an SSL error on rebuild, with the cert not being recognized and “connection refused” message when attempting to load the forum page. Some further information, we use our own SSL cert.

[صورة] tanya_byrne: the cert not being recognized and “connection refused” message These two errors are mutually exclusive… Sorry, nginx doesn’t have set_header - I misremembered and it’s from another tool. The easiest option is probably editing templates/web.ssl.template.yml with the new values you want.

الطريقة المدعومة لإضافة "IncludeSubdomain" إلى ترويسات STS

مطور

tanya_byrne (kukulaka) 11 يناير 2026، 12:07ص 7

شكراً لمساعدتكما!

الموضوع		الردود	مرات العرض
Help adding includeSubDomains to the Strict-Transport-Security header Self-hosting hosting	4	337	22 سبتمبر 2025
Set Strict-Transport-Security header Self-hosting	2	701	10 أكتوبر 2022
Add a custom HTTP header to requests made to your Discourse Sysadmins how-to	5	4921	12 سبتمبر 2016
HSTS header not set with www and non www setup Product Support nginx	2	865	6 أكتوبر 2022
Let’s Encrypt problem after upgrading to 1.9.0.beta3 Bug	13	1852	14 يوليو 2017

الطريقة المدعومة لإضافة "IncludeSubdomain" إلى ترويسات STS

الموضوعات ذات الصلة