Security headers › Strict-Transport-Security
How to add the Strict-Transport-Security header in Next.js
HSTS tells browsers to only ever connect to your site over HTTPS for the given time, even if someone types http:// or follows an old link.
Next.js configuration (next.config)
async headers() {
return [
{
source: "/:path*",
headers: [{ key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" }],
},
];
}Add the headers() function to your Next.js config and restart or redeploy. Headers set by a proxy or CDN in front can override these.
Before you deploy
Only send it once HTTPS works on every subdomain if you use includeSubDomains. Add preload and submit to hstspreload.org only when you are sure, because removal takes months.
Verify it works
curl -sI https://your-site.com | grep -i strict-transport-securityOr run a free Korrali Web scan to check this and every other security header at once.