I added Strict-Transport-Security: max-age=63072000; includeSubDomains; preload to headers() in next.config.js on this site , and www served it. The apex, mohamedgado.com , still answered with Vercel's default max-age=63072000 and nothing else. hstspreload.org checks the apex, so the domain could not be submitted. The cause was the apex redirect. It was set in Vercel's Domains settings, and a domain-level redirect is answered before your project runs, so headers() never touches it. The fix was to move that redirect into redirects() in next.config.js and set the apex domain to serve Production.

Why did http://mohamedgado.com take two redirects?

This started as a crawl finding. Typing http://mohamedgado.com took two hops:

http://mohamedgado.com/ 308 -> https://mohamedgado.com/ https://mohamedgado.com/ 308 -> https://www.mohamedgado.com/

Enter fullscreen mode

Exit fullscreen mode

Vercel upgrades every HTTP request to HTTPS on the same host first, with a 308 .…