nginx: HSTS: subdomains & preload

etc/nginx/sites-enabled/host

@@ -31,7 +31,7 @@ server {
     ssl_prefer_server_ciphers on;
 
     # Enable this if your want HSTS (recommended)
-    add_header Strict-Transport-Security max-age=15768000;
+    add_header Strict-Transport-Security "max-age=15552000; includeSubdomains; preload";
 
     # OCSP Stapling ---
     # fetch OCSP records from URL in ssl_certificate and cache them

etc/nginx/sites-enabled/rproxy

@@ -4,6 +4,9 @@ server {
     listen 443;
     listen [::]:443;
 
+    # Enable this if your want HSTS (recommended)
+    add_header Strict-Transport-Security "max-age=15552000; includeSubdomains; preload";
+
     server_name something.example.org;
 
 # NOTE: For X-Real-IP & X-Forwarded-For see ../conf.d/rproxy.conf

etc/nginx/sites-enabled/vhost

@@ -6,6 +6,9 @@ server {
     listen 443;
     listen [::]:443;
 
+    # Enable this if your want HSTS (recommended)
+    add_header Strict-Transport-Security "max-age=15552000; includeSubdomains; preload";
+
     root /var/www/vhostdir;
     index index.php index.html index.htm;