I just got off a chat with Shopify Support with no real viable solution so wanted to pose it to the community. I would like to add my website to the HSTS Preload List for a little additional website security but apparently some of the headers set by Shopify do not pass the minimum requirements despite the Shopify documentation stating that it does.
From what I can see, the “includeSubDomains” and “preload” directives are missing and the max-age is set to low. The solution provided to me by support was to completely rebuild my website from scratch using Hydrogen which is not really a viable solution at this point. I feel Shopify simply updating their default server header config to meet these minimum requirements would be the best solution here but if they are unable or unwilling to do this, does anyone else out there have any suggestions?
To Shopify, I personally don’t see any issue with updating these security features since they seem to be pretty accepted in the security community however I understand that doing so would affect everyone on your servers. Ultimately, I feel this would be an improvement for all of your users and something that should really be considered at the server level. Just a suggestion.
Hi Jeff - thanks for flagging this, it does sound that this is a limit where devs or merchants using Liquid-based themes don’t have access to serve an HSTS header on the base domain for HTTPS requests. Can you link the docs where it says that themes meet the HSTS Preload Submission Requirements?
Thanks for the quick reply Liam. I got the information from Shopify Plus support chat. They said they were copying it from their docs but didn’t provide the source so the docs in question may be internal? Regardless, here is the response I was given:
Here’s what’s happening with your domain security:
The good news: Shopify automatically handles HSTS (that’s the security feature that keeps your site secure) for all connected domains. It’s already working to protect your store with a 90-day policy.
What this means for you:
- Your domain gets automatic security protection while connected to Shopify
- If you ever disconnect your domain, the protection continues for another 90 days
- You can’t customize these settings yourself - we manage them to keep your store secure
About the HSTS preload list: If you want your domain added to browser preload lists, our default settings already meet those requirements. You can check your status using online HSTS checkers if you’re curious.
Need more control? For advanced HSTS customization, you’d need a custom solution like Hydrogen. But for most stores, our automatic management works perfectly.
Having connection issues? Double-check that your domain is properly connected in Settings > Domains, and make sure your DNS and SSL are set up correctly.
It’s that “About the HSTS preload list” paragraph I’m referring to. I agree that the default settings should be set up to meet these requirements since I don’t really see any downside in doing so but that’s just not the case from what I can see. I’d love to see Shopify make the changes needed to make this statement true. I’m not asking to have access to make this change myself but I don’t understand why Shopify wouldn’t want to meet this security requirement.
Hi again @Jeff_Nelon
From digging into this, it seems that Shopify domains may not be preloaded, but HSTS is enforced at the storefront level. It’s not currently possible to customise the headers, but our internal team are aware of this as a feature request.