Fix the Nextcloud Strict-Transport-Security (HSTS) Header Missing Warning

When Nextcloud reports “The Strict-Transport-Security HTTP header is not configured,” the fix belongs on the HTTPS response-serving layer: Apache, Nginx, or the public reverse proxy that terminates TLS. Nextcloud’s current administration manual identifies a missing header or a max-age below 15552000 seconds as a security warning. Once the header is present on the public HTTPS endpoint, browsers can remember that the host must use HTTPS for the declared period.

The basic change is small, but its scope matters. Apply HSTS only to a working HTTPS endpoint with a valid certificate. Start with the host only; add includeSubDomains or preload only when every affected hostname is ready for HTTPS. This guide reflects the Nextcloud administration documentation available in October 2026, including its security warning guidance and server hardening guidance.

What the warning means

HTTP Strict Transport Security (HSTS) is a response header that tells a browser to use HTTPS for future requests to a hostname. It helps prevent a browser from falling back to plaintext HTTP after it has received the policy over a valid HTTPS connection. Nextcloud checks the public response and warns when it does not see a policy with the recommended minimum lifetime.

HSTS is not a substitute for enabling TLS or redirecting HTTP to HTTPS. The browser only accepts an HSTS policy delivered over HTTPS. On a first visit, before the browser has learned the policy, the initial request can still be vulnerable unless the hostname is covered by a browser preload list. A normal HTTP-to-HTTPS redirect remains useful, but does not replace the header.

Find which server should send the header

Trace the public request before changing configuration. If users connect directly to Apache or Nginx over HTTPS, configure that web server’s TLS virtual host. If a load balancer, ingress, CDN, or reverse proxy terminates public TLS, configure the layer that sends the response to the browser. Adding the header only to an internal HTTP connection may not affect the public response.

Nextcloud documents reverse proxies as a supported deployment pattern and requires administrators to define trusted proxies when applicable. The proxy’s HSTS responsibility is separate from Nextcloud’s URL and client-IP handling. In particular, overwriteprotocol helps Nextcloud recognize the external scheme in some proxy layouts; setting it does not itself add the HSTS response header. Review the official Nextcloud reverse-proxy configuration guide if the application generates HTTP links or reports other proxy-related warnings.

Before changing the policy

• Confirm https://cloud.example.com loads without a certificate error and uses the intended certificate chain.
• Check whether HTTP requests redirect to the same hostname over HTTPS.
• Identify other services and subdomains under the same parent domain before considering includeSubDomains.
• Keep an administrative route or server console available. A browser that has cached HSTS will refuse to let a user bypass certificate errors for the policy period.

Replace cloud.example.com in examples with your real Nextcloud hostname. Do not copy sample hostnames into production configuration.

Set HSTS in Apache

In the Apache TLS virtual host that serves Nextcloud, enable the headers module and add the policy. Nextcloud’s hardening guide shows a six-month value and uses includeSubDomains; the following host-only version is a cautious starting point:

<VirtualHost *:443>
    ServerName cloud.example.com

    <IfModule mod_headers.c>
        Header always set Strict-Transport-Security "max-age=15552000"
    </IfModule>

    # Existing Nextcloud and TLS directives
</VirtualHost>

Ensure mod_headers is enabled in your distribution’s Apache setup. Add the directive to the HTTPS virtual host, not the port 80 virtual host. Validate the configuration using the command appropriate for the installed distribution, then reload Apache using its service manager. For example, many systemd-based distributions support sudo apachectl configtest followed by sudo systemctl reload apache2; on some distributions, the service is named httpd. Use the command that matches your package and service names.

Set HSTS in Nginx

In the Nginx server block that listens for HTTPS and serves the public Nextcloud hostname, add:

server {
    listen 443 ssl;
    server_name cloud.example.com;

    add_header Strict-Transport-Security "max-age=15552000" always;

    # Existing certificate and Nextcloud configuration
}

The always parameter makes Nginx add the header regardless of response status. Nginx documents an inheritance rule that can surprise operators: add_header directives at a lower configuration level change the normal inheritance behavior. If a nested location block defines its own add_header directives, the server-level HSTS header may no longer be inherited there. Check the active configuration and test representative URLs, including the login page and a static resource. See the official Nginx headers module documentation.

Before applying changes, run sudo nginx -t. If validation succeeds, reload Nginx using the service command for your system, often sudo systemctl reload nginx. A failed syntax test should be corrected before reloading.

Configure a reverse proxy or TLS terminator

If public HTTPS ends at a reverse proxy, put the HSTS header on that proxy’s HTTPS response. For example, a proxy may send it even when its connection to the Nextcloud backend uses HTTP. Do not send HSTS only on the unencrypted backend response and assume that the browser will see it.

Check whether both proxy and backend already add the same header. Duplicate HSTS fields can be confusing to diagnose, and a proxy may overwrite or hide a backend header. Choose one public-facing layer to own the policy, or deliberately configure the layers so the browser receives one clear value. After changing the proxy, confirm that it forwards the expected host and scheme to Nextcloud and that HTTPS links still work.

Verify the public response

Use a request to the public HTTPS hostname, not only a localhost or backend address:

curl -sSI https://cloud.example.com
curl -sSIL http://cloud.example.com

In the first response, look for exactly one header similar to:

Strict-Transport-Security: max-age=15552000

The second command follows redirects. Confirm that the HTTP URL reaches the intended HTTPS hostname, then inspect the HTTPS response for HSTS. Browsers ignore HSTS received over plain HTTP, so the header need not appear on the initial port 80 redirect. You can also use browser developer tools: open the Network panel, reload the HTTPS page, select the document response, and inspect response headers.

Check more than one response path if your configuration has nested locations, multiple proxy tiers, or separate static-asset handling. Then revisit Nextcloud’s Administration settings and refresh its security overview. A warning can take time to refresh or may reflect the exact public URL Nextcloud probes, so compare that URL with the one you tested.

Choose scope and lifetime carefully

A max-age of 15552000 seconds is six months, matching Nextcloud’s documented warning threshold. The policy is renewed when a browser receives a new valid HSTS header. Shortening or removing it later requires delivering max-age=0 over HTTPS to each affected hostname; browsers that do not revisit during the change will retain their cached policy until its current lifetime expires.

includeSubDomains applies the policy to every subdomain beneath the hostname. Use it only if all current and planned subdomains support HTTPS with valid certificates. A separate service such as mail.example.com or legacy.example.com can become inaccessible to browsers if it is not ready.

The preload token is a separate, high-impact decision. Nextcloud’s hardening guidance describes adding a hostname to browser preload lists, and warns that removal can take months to reach installed browsers. Do not add it as a quick way to clear a scanner finding. Confirm all required preload conditions and the impact on every subdomain first; follow the official HSTS Preload service guidance if you intend to request inclusion.

If the warning remains

• The header is absent in curl: you may have edited the wrong virtual host, proxy, or Nginx location. Inspect the public DNS target and active server configuration.
• The header appears only on some pages: check nested Nginx add_header directives, error handling, static asset paths, and proxy rules.
• The response has multiple policies: find which layers add the field and consolidate them into one consistent value.
• The header is present but the warning persists: verify that Nextcloud’s externally configured URL resolves to the same HTTPS endpoint, check proxy scheme handling, then reload the Admin overview.
• HTTPS or the certificate is not ready: fix TLS and HTTP-to-HTTPS routing first. HSTS cannot repair a broken certificate or enable HTTPS on its own.

The fix is complete when the public HTTPS response consistently carries the intended HSTS value, Nextcloud can reach its public HTTPS URL correctly, and the browser can load the instance without certificate or redirect errors. HSTS improves transport policy enforcement for returning browsers; it does not replace certificate maintenance, secure proxy configuration, or a tested recovery path.