You are right, my problem was that I didn’t understand how adding headers works in nginx, but it was the other way around - I assigned HSTS header globally, but then assigned other headers on nextcloud subfolder level, which canceled root level assessment. So when I checked mydomain.org in SSL test portal, I passed, but my nextcloud instance in DOMAIN FOR SALE was not adding this header.
Thanks for the tip though.
1 Like