Add HSTS to Drupal sites if they are not behind a proxy

templates/vhost.conf

@@ -39,6 +39,8 @@
   ServerAlias {{ drupal_domain.domain }}{% for alias in drupal_domain.aliases|default([]) %} {{ alias }}{% endfor %}
 {% endif %}
 
+  Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
+
 {% if drupal.jail is defined %}
   ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:{{ drupal.jail.port }}{{ drupalRoot }}/$1
 {% endif %}
@@ -146,6 +148,8 @@
   ServerName  dummy.{{ drupal_domain.domain }}
   ServerAlias {% for redirect in drupal_domain.redirects|default([]) %} {{ redirect }}{% endfor %}{% if drupal_domain.aliases_redirect|default(False) %}{% for alias in drupal_domain.aliases|default([]) %} {{ alias }}{% endfor %}{% endif %}
 
+  Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
+
   RewriteEngine on
   RewriteRule ^ https://{{ drupal_domain.domain }}%{REQUEST_URI} [END,QSA,R=permanent]