How do I enable HSTS on Magento (and what max-age?)

HSTS is set at the web-server layer, not in Magento itself. Three places:

• nginx (most Magento hosting): add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; inside the SSL server block.
• Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" in the SSL VirtualHost.
• Cloudflare / Fastly / CDN edge: set the header at the edge; same value.

Magento Admin → Stores → Configuration → Web → Use Secure URLs On Storefront + Admin = Yes. This makes Magento generate https:// URLs everywhere, HSTS then enforces the protocol at the browser.

max-age guidance:

• Testing: Start with max-age=300 (5 minutes) for the first hour, verify nothing breaks.
• Staging: Move to max-age=86400 (1 day) and run a week of traffic.
• Production: Set to max-age=31536000 (1 year) with includeSubDomains and preload.
• HSTS Preload list: Submit at hstspreload.org after 90+ days of stable 1-year max-age. Removal takes months, only preload when you’re sure.

The audit’s q7 specifically rewards a 1-year max-age with includeSubDomains. Shorter values count as partial credit; missing entirely is a "No".