Make HSTS optional

Valian · Dec 2, 2017 · 538bf90 · 538bf90
1 parent 0079d55
commit 538bf90
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/snippets/ssl.conf b/snippets/ssl.conf
@@ -14,4 +14,5 @@ ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECD
 ssl_prefer_server_ciphers on;
 
 # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
-add_header Strict-Transport-Security max-age=15768000;
+# uncomment if you are sure you'll never drop HTTPS support
+# add_header Strict-Transport-Security max-age=15768000;