0

I have this notice in the Semrush saying '1 subdomains don't support HSTS' I am able to remove this notice by removing the following lines from

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteCond %{HTTP_HOST} !^localhost
RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
RewriteCond %{REQUEST_URI} !^/\.well-known
RewriteRule ^(.*)$ https://%1$1 [R=permanent,L]

However when I goto my website it will no longer redirect www to non-www, which we really do not want, is there anyway of having a subdomain support HSTS while it also redirects www to non-www? Is this possible?

In addition, this is annoying because now in Semrush I get duplicate warnings because of www and non-www

Here is my full Virtual Host

<VirtualHost _default_:443>
ServerName example.com
DocumentRoot "/opt/bitnami/apache2/htdocs/example/“
SSLEngine on
SSLCertificateFile "/opt/bitnami/apache2/conf/crt.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/key.key"

  # BEGIN: Support domain renewal when using mod_proxy without Location
  <IfModule mod_proxy.c>
    ProxyPass /.well-known !
  </IfModule>
  # END: Support domain renewal when using mod_proxy without Location
  # BEGIN: Enable www to non-www redirection
  RewriteEngine On
  RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
  RewriteCond %{HTTP_HOST} !^localhost
  RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
  RewriteCond %{REQUEST_URI} !^/\.well-known
  RewriteRule ^(.*)$ https://%1$1 [R=permanent,L]
  # END: Enable www to non-www redirection
  <Directory "/opt/bitnami/apache2/htdocs/example">
    Options Indexes FollowSymLinks
    AllowOverride All
    <IfVersion < 2.3 >
Order allow,deny
Allow from all
    </IfVersion>
    <IfVersion >= 2.3 >
Require all granted
    </IfVersion>
  </Directory>

  # Error Documents
  ErrorDocument 503 /503.html

  # Bitnami applications installed with a prefix URL (default)
  Include "/opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf"
  # BEGIN: Support domain renewal when using mod_proxy within Location
  <Location /.well-known>
    <IfModule mod_proxy.c>
ProxyPass !
    </IfModule>
  </Location>
  # END: Support domain renewal when using mod_proxy within Location
</VirtualHost>

And here is the non https VH

<VirtualHost _default_:80>
DocumentRoot "/opt/bitnami/apache2/htdocs"
# BEGIN: Support domain renewal when using mod_proxy without Location
<IfModule mod_proxy.c>
    ProxyPass /.well-known !
  </IfModule>
  # END: Support domain renewal when using mod_proxy without Location
  # BEGIN: Enable HTTP to HTTPS redirection
  #RewriteEngine On
  #RewriteCond %{HTTPS} !=on
  #RewriteCond %{HTTP_HOST} !^localhost
  #RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
  #RewriteCond %{REQUEST_URI} !^/\.well-known
  #RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R=301,L]
  #Header always set Strict-Transport-Security max-age=31536000
  # END: Enable HTTP to HTTPS redirection
  # BEGIN: Enable www to non-www redirection
  #RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
  #RewriteCond %{HTTP_HOST} !^localhost
  #RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
  #RewriteCond %{REQUEST_URI} !^/\.well-known
  #RewriteRule ^(.*)$ http://%1$1 [R=permanent,L]
  # END: Enable www to non-www redirection
  <Directory "/opt/bitnami/apache2/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride All
    <IfVersion < 2.3 >
Order allow,deny
Allow from all
    </IfVersion>
    <IfVersion >= 2.3 >
Require all granted
    </IfVersion>
  </Directory>

  # Error Documents
  ErrorDocument 503 /503.html

  # Bitnami applications installed with a prefix URL (default)
  Include "/opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf"
  # BEGIN: Support domain renewal when using mod_proxy within Location
<Location /.well-known>
<IfModule mod_proxy.c>
ProxyPass !
</IfModule>
</Location>
# END: Support domain renewal when using mod_proxy within Location
</VirtualHost>
user979331
  • 11,039
  • 73
  • 223
  • 418
  • See https://serverfault.com/questions/1044319/hsts-and-wordpress-redirection-to-www-and-non-www-and-https-avoid-multiple-red - You need to redirect `http://example.com` first to `https://example.com`, serve HSTS headers there too, and only then in a second redirect forward the browser to `https://www.example.com`. Otherwise `example.com` won't use HSTS and an attacker could hijack it to redirect `http://example.com` directly to `https://malicious.example.net` instead of `https://www.example.com`. – CherryDT Feb 07 '22 at 22:27
  • I understand, I added my Virtual Host to the question, my question is do I need to add the first redirect to my 443 VH or my 80 VH? – user979331 Feb 07 '22 at 22:33

0 Answers0