# 帮助将 includeSubDomains 添加到 Strict-Transport-Security 标头

**URL:** <https://meta.discourse.org/t/help-adding-includesubdomains-to-the-strict-transport-security-header/381983>\
**Category:** Self-hosting\
**Tags:** hosting\
**Created:** [2025年九月8日 21:09 UTC](https://meta.discourse.org/t/help-adding-includesubdomains-to-the-strict-transport-security-header/381983 "2025-09-08T21:09:38Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)\
**Post date:** [2025年九月8日 21:09 UTC](https://meta.discourse.org/t/help-adding-includesubdomains-to-the-strict-transport-security-header/381983/1 "2025-09-08T21:09:38Z")

</div>

一位客户使用了一个有用的安全扫描器，现在认为 Strict-Transport-Security 标头应包含 ‘includeSubdomains’。

我在 `app.yml` 中添加了这两项：

```yaml

  after_ssl:
    - replace:
        filename: /etc/nginx/conf.d/outlets/server/20-https.conf
        from: "max-age=31536000;"
        to: "max-age=31536000; includeSubDomains;"
    - replace:
        filename: /etc/nginx/conf.d/outlets/discourse/20-https.conf
        from: "max-age=31536000;"
        to: "max-age=31536000; includeSubDomains;"

```

```yaml
- exec: sed -i "s/add_header Strict-Transport-Security 'max-age=31536000';/add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;/" /etc/nginx/conf.d/outlets/discourse/20-https.conf /etc/nginx/conf.d/outlets/server/20-https.conf

```

两者似乎都不起作用。在容器内运行第二个 `sed` 命令可以正常工作，并在重新启动 nginx 后按要求执行。

我不明白为什么它不起作用。

另外，这以前在模板中，但似乎在 2014 年被删除了，但最近的一些帖子包含显示 `includeSubdomains` 的标头。

我感到困惑。

---

_[View the full topic](https://meta.discourse.org/t/help-adding-includesubdomains-to-the-strict-transport-security-header/381983)._