Let Caddy's HSTS header replace the one HeyForm sends

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-31 17:49:15 -06:00
parent 9b4df20080
commit d1770a87e5
1 changed files with 5 additions and 1 deletions
@@ -1,7 +1,11 @@
 # Tell browsers to always use HTTPS for each site for a year. No
 # includeSubDomains, so hosts not served here are unaffected.
+# defer: replace any HSTS header an app sends itself, so there's only one.
 (hsts) {
-    header Strict-Transport-Security "max-age=31536000"
+    header {
+        Strict-Transport-Security "max-age=31536000"
+        defer
+    }
 }

 {{ subdomains.pocketid }} {