# NGINX: "Strict-Transport-Security" HTTP header is not configured to at least "15768000" seconds **URL:** \ **Category:** ℹ️ Support\ **Created:** [June 18, 2016, 12:52pm UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916 "2016-06-18T12:52:23Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![nephilim](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nephilim/32/2760_2.png) [@nephilim](https://help.nextcloud.com/u/nephilim)\ **Post date:** [June 18, 2016, 12:52pm UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/1 "2016-06-18T12:52:23Z")
Hej in admin panel I see a security warning: `Der "Strict-Transport-Security" HTTP-Header ist nicht auf mindestens "15768000" Sekunden eingestellt. Um die Sicherheit zu erhöhen, empehlen wir das Aktivieren von HSTS, wie es in den Sicherheitshinweisen erläutert ist.` Usually I added this code: `Header set Strict-Transport-Security "max-age=15768000" env=HTTPS` into the /var/www/owncloud/.htaccess but this isn’t working. Any idea to get this fixed? System: nginx/1.6.2 & PHP 5.6.22 & Nc 9.0.55 Kind regards //nephilim ---
**Author:** ![Zollak](https://help.nextcloud.com/letter_avatar/zollak/32/5_5575768a8748004e209b776fc1b2916d.png) [@Zollak](https://help.nextcloud.com/u/Zollak)\ **Post date:** [June 18, 2016, 1:37pm UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/2 "2016-06-18T13:37:48Z")
NGINX does not support .htaccess files. [https://www.nginx.com/resources/wiki/start/topics/examples/likeapache-htaccess/](https://www.nginx.com/resources/wiki/start/topics/examples/likeapache-htaccess/) To use HSTS with NGINX, you should add the following line to your server block: `add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";` You can also have a look at the documentation for config files to use with NGINX. [https://docs.nextcloud.org/server/9/admin\_manual/installation/nginx\_owncloud\_9x.html](https://docs.nextcloud.org/server/9/admin_manual/installation/nginx_owncloud_9x.html) ---
**Author:** ![nephilim](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nephilim/32/2760_2.png) [@nephilim](https://help.nextcloud.com/u/nephilim)\ **Post date:** [June 18, 2016, 4:30pm UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/3 "2016-06-18T16:30:05Z")
I used the config you are referring to. But it wasn’t part of it. Thank you so much for this hint. Issue solved. 🙂 ---
**Author:** ![sami](https://help.nextcloud.com/letter_avatar/sami/32/5_5575768a8748004e209b776fc1b2916d.png) [@sami](https://help.nextcloud.com/u/sami)\ **Post date:** [October 17, 2016, 7:33am UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/4 "2016-10-17T07:33:14Z")
Hello, I have the same problem after a new nextcloud 10.0.1 installation. I paste the following code into the nextcloud .htacces file. # Strict-Transport-Security: Header always set Strict-Transport-Security “max-age=15552000; includeSubDomains” But it doesn’t work. After that, I paste the code into the main www .htacces file. It doesn’t work too. I use a apache 2.4 server and is restarted. Best regards, Christoph ---
**Author:** ![dev0](https://help.nextcloud.com/letter_avatar/dev0/32/5_5575768a8748004e209b776fc1b2916d.png) [@dev0](https://help.nextcloud.com/u/dev0)\ **Post date:** [October 17, 2016, 7:56am UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/5 "2016-10-17T07:56:43Z")
did you install and enable mod\_headers? ---
**Author:** ![sami](https://help.nextcloud.com/letter_avatar/sami/32/5_5575768a8748004e209b776fc1b2916d.png) [@sami](https://help.nextcloud.com/u/sami)\ **Post date:** [October 17, 2016, 8:24am UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/6 "2016-10-17T08:24:35Z")
yes it is installed and enable. apache is multiple times restarted. ---
**Author:** ![Thor](https://help.nextcloud.com/user_avatar/help.nextcloud.com/thor/32/521_2.png) [@Thor](https://help.nextcloud.com/u/Thor)\ **Post date:** [October 17, 2016, 8:33am UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/7 "2016-10-17T08:33:36Z")
I had the same issue, for me this helped: [http://www.synology-forum.de/showthread.html?76163-DSM-6-und-HSTS/page2&p=638567&viewfull=1#post638567](http://www.synology-forum.de/showthread.html?76163-DSM-6-und-HSTS/page2&p=638567&viewfull=1#post638567) This is a solution for Synology DIscstations but I think it also works on other environments in some way. For non-German speakers, here is a trnslation: 1. Log in at you DS via SSH 2. Get root access “sudo su -” (without " ") using the admin password 3. Create a new file in /etc/nginx/conf.d named “http.\*.conf” (replace the \* with something else), if you only want “hsts” the name could be “http.hsts.conf” (e.g. command “nano /etc/nginx/conf.d/http.hsts.conf”) 4. Add ‘add\_header Strict-Transport-Security “max-age=15768000; includeSubDomains; preload;”;’ (without ') 5. Save and close the file 6. Reload Nginx Config. “nginx -s reload” ---
**Author:** ![tflidd](https://help.nextcloud.com/letter_avatar/tflidd/32/5_5575768a8748004e209b776fc1b2916d.png) [@tflidd](https://help.nextcloud.com/u/tflidd)\ **Post date:** [October 17, 2016, 8:57am UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/8 "2016-10-17T08:57:27Z")
Please don’t mix topics! The OP was using an nginx webserver and his problem was solved. Don’t come up with a different setup here, open a new topic for that. Closing this thread. ---
**Author:** ![tflidd](https://help.nextcloud.com/letter_avatar/tflidd/32/5_5575768a8748004e209b776fc1b2916d.png) [@tflidd](https://help.nextcloud.com/u/tflidd)\ **Post date:** [October 17, 2016, 8:57am UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/9 "2016-10-17T08:57:32Z")
---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 4, 2024, 3:20pm UTC](https://help.nextcloud.com/t/nginx-strict-transport-security-http-header-is-not-configured-to-at-least-15768000-seconds/916/10 "2024-12-04T15:20:15Z")