# Set Strict-Transport-Security header

**URL:** https://meta.discourse.org/t/set-strict-transport-security-header/241114
**Category:** Self-hosting
**Created:** [October 6, 2022, 10:14am UTC](https://meta.discourse.org/t/set-strict-transport-security-header/241114 "2022-10-06T10:14:35Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![OrkoGrayskull](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/orkograyskull/32/275883_2.png) [@OrkoGrayskull](https://meta.discourse.org/u/OrkoGrayskull)
#### Post date: [October 6, 2022, 10:14am UTC](https://meta.discourse.org/t/set-strict-transport-security-header/241114/1 "2022-10-06T10:14:35Z")

</div>

Hello there,

I want to modify the Strict-Transport-Security header. I use this code in my app.yml:

```plaintext
run:  
# nginx modifications
  - replace:       
      filename: "/etc/nginx/conf.d/discourse.conf"       
      from: /add_header Strict-Transport-Security.+/       
      to: "add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains; preload';"

```

This works for the first occurrence:  
`add_header Strict-Transport-Security 'max-age=63072000';`

But there is another one with:

```plaintext
location @discourse {
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain

```

Am I doing something wrong? Why is the second occurrence of Strict-Transport-Security header not modified?

---

<div class="post-metadata">

### Author: ![OrkoGrayskull](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/orkograyskull/32/275883_2.png) [@OrkoGrayskull](https://meta.discourse.org/u/OrkoGrayskull)
#### Post date: [October 10, 2022, 10:18am UTC](https://meta.discourse.org/t/set-strict-transport-security-header/241114/2 "2022-10-10T10:18:16Z")

</div>

I’ve tested with several customizations. Only the first occurrence of

`add_header Strict-Transport-Security`

is replaced. Any hints to get this done?

---

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [October 10, 2022, 10:22am UTC](https://meta.discourse.org/t/set-strict-transport-security-header/241114/3 "2022-10-10T10:22:03Z")

</div>

You need to add `global: true` to the replace command parameters.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [November 9, 2022, 10:22am UTC](https://meta.discourse.org/t/set-strict-transport-security-header/241114/4 "2022-11-09T10:22:16Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.