From 97f38ef2b5278c19f0dfddad5b60d42c51d69491 Mon Sep 17 00:00:00 2001
From: ma-04 <120931948+ma-04@users.noreply.github.com>
Date: Tue, 28 Jul 2026 14:21:25 +0600
Subject: [PATCH] fix(nginx): remove HSTS from opt-in security headers to avoid
 duplicate

The nginx-proxy edge layer in front of every FlyWP site already sends
its own Strict-Transport-Security header unconditionally, regardless
of the per-site security-headers toggle. Now that the add_header
shadowing bug (35b254a) is fixed, sites with the toggle on also send
their own HSTS from security-headers.conf, resulting in two
Strict-Transport-Security headers in the response.

Drop HSTS from security-headers.conf since the edge already provides
baseline HSTS to every site independent of the toggle; deduping at the
edge is out of scope here since that's a separate system. The toggle
continues to control CSP, X-Frame-Options, X-Content-Type-Options,
X-XSS-Protection, and Referrer-Policy.
---
 nginx/common/security-headers.conf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nginx/common/security-headers.conf b/nginx/common/security-headers.conf
index 6824dac..4bb4679 100644
--- a/nginx/common/security-headers.conf
+++ b/nginx/common/security-headers.conf
@@ -1,4 +1,3 @@
-add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
 add_header Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'; frame-src 'self' https: blob:; script-src 'self' https: 'unsafe-inline' 'unsafe-eval';" always;
 add_header X-XSS-Protection "1; mode=block" always;
 add_header X-Frame-Options "SAMEORIGIN" always;