HSTS in Drupal konfigurieren

# seckit HSTS: /admin/config/system/seckit → Tab "HSTS"
# Checkboxen aktivieren:
✓ HTTP Strict Transport Security
Max-Age: 31536000
✓ includeSubDomains
✓ preload

# Speichern → drush cr

<?php
// modules/custom/security_headers/src/EventSubscriber/HstsSubscriber.php

namespace Drupal\security_headers\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class HstsSubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents() {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event) {
    $response = $event->getResponse();
    $response->headers->set(
      'Strict-Transport-Security',
      'max-age=31536000; includeSubDomains; preload'
    );
  }
}

# .htaccess — HSTS-Fallback
# ACHTUNG: Core-Updates überschreiben die .htaccess!
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>