Set Strict-Transport-Security "max-age=15552000"

ℹ️ Support
1

Hello

After every nextcloud update I get the error message

Der "Strict-Transport-Security“-HTTP-Header ist nicht auf mindestens "15552000“ Sekunden eingestellt. Für mehr Sicherheit wird das Aktivieren von HSTS empfohlen, wie es in den [Sicherheitshinweisen ↗](https://docs.nextcloud.com/server/24/go.php?to=admin-security) erläutert ist.

I know the solution. I just have a add the following lines to my .htaccess

<IfModule mod_headers.c>
 Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
  <IfModule mod_setenvif.c>

But what can I do to prevent that I have to do this every single time. Why is the update changing every time my .htaccess? Is there any way to add the three lines automatically? Or can i just set the file write protection of the file? I do not know if this would be a good idea.

2

I added it to the Apache site config and never had to redo it.

3 Likes