tl;dr: So far, the Netlify hosting platform issued redirects from HTTP to HTTPS and redirects to the primary domain of a site for requests that reached static assets only. In coming weeks, we will revise our systems to issue these redirects for all requests to your site going forward. What are TLS …

There still appears to be a common configuration that cannot be made compliant to the HSTS preload standard in Netlify where the apex domain redirects to a subdomain via a primary domain redirect. If a site’s apex domain https://example.com redirects to a subdomain, e.g., https://www.example.com, t…

You could set a custom HSTS header yourself, see the HSTS Preload section at HTTPS (SSL) | Netlify Docs . I personally did that and my domains are preloaded just fine and the custom one will override the default HSTS header set by Netlify.

If my test is anything to go by, the redirect from www to non-www (which is automagically implemented by Netlify) does not honour the HSTS header @hartanto # _headers /* Strict-Transport-Security: max-age=31536000; includeSubDomains; preload # Other headers as required... as evident in % curl…

Hmm, you are correct. This used to work correctly I believe… It seems now Netlify strips all custom headers from the 301 redirects.

The automagic redirect sits in front of everything else: Redirects, Headers, and even Edge Functions (at least from what I established from the multiple sites have deployed as tests.) I don’t know if there is any possibility for Netlify to allow custom headers on these redirects or not.

@coelmay and @hartanto thanks for the follow-ups and confirming what I should have made clearer in my original post. Site redirects configured using _redirects file or in the netlify.toml file can be configured to follow the HSTS preload standard. However, primary domain redirects (what @coelmay has…

Improvements to TLS and primary domain redirects for non-static assets

Features Updates

cataclysm October 6, 2022, 3:03pm 13

Moved discussion to its own thread: Primary domain redirects do not support HSTS preload standard.

Topic		Replies	Views
Primary domain redirects do not support HSTS preload standard Support netlify-dns-https-ssl , redirects , headers	4	1305	October 18, 2022
How to group HTTPS and WWW redirects to one redirect? Support redirects	4	301	April 25, 2024
Redirect Directly to Primary Domain for Domain Aliases with SSL instead of 2 hops Features netlify-dns-https-ssl	7	2597	February 28, 2022
My site has HTTPS enabled, but sometimes the non-secure site is loaded Support netlify-dns-https-ssl	2	2040	November 18, 2020
Http > https _redirects not working as expected Support netlify-dns-https-ssl	10	863	July 29, 2022

Improvements to TLS and primary domain redirects for non-static assets

Related topics