Modify headers for Security

Shopify Discussion

Topic summary

A user needs to modify their Strict-Transport-Security (HSTS) headers to include specific directives: max-age, includeSubdomains, and preload. They’re asking whether this is possible without a Shopify Plus subscription.

Current Status:

  • Initial response suggested contacting Shopify support directly for security-related modifications
  • User reports that Shopify support redirected them back to the community forum

Key Question:
Whether non-Plus merchants can customize HTTP security headers on Shopify stores remains unanswered. The discussion appears ongoing with no resolution yet provided.

Summarized with AI on November 1. AI used: claude-sonnet-4-5-20250929.
1

I need to update my Strict-transport-security headers with maxage, includeSubdomains and preload. Can you do this without Shopify Plus?

2

Hi @kcampbellreman , thanks for reaching out.

I checked your issue and would like to inform you that for security concerns, I recommend you contact the Shopify support team directly. They can provide you with more details on Shopify’s security policies and whether any adjustments can be made for your store.

Thanks for your understanding in this matter and I hope my information is helpful to you.

Liz

3

Thank you for responding. I contacted Shopify support and they directed me to the community.