Strict-Transport-Security ignored: invalid max-age value

Strict-Transport-Security ignored: invalid max-age value

TL;DR

The Strict-Transport-Security header carries a max-age the browser cannot parse, so the whole header is ignored. Set it to a plain integer number of seconds (e.g. 31536000). Quoted values, units, or typos all invalidate it.

Strict-Transport-Security: invalid max-age value (header ignored)

Steps

1. Read the served header value exactly. Expected: You see the malformation (quotes, 'days', a typo).

2. Set it to a plain integer: Strict-Transport-Security: max-age=31536000. Expected: The value parses.

3. Verify in the browser devtools: the header is accepted and HSTS is active for the host. Expected: No more ignored warning.

4. Consider includeSubDomains and preload once the base header is proven. Expected: The policy strengthens deliberately.

5. Check every host serving the header; one bad value on one host is enough to confuse. Expected: All hosts are consistent.

When to use

• browsers report HSTS ignored on max-age
• the header value looks unusual
• HSTS is not taking effect

When not to use

• the header is absent entirely (add it, do not fix the value)
• the value is valid but HSTS still fails (check for HTTP serving or cert issues)
• you are testing on a local loopback address (browsers handle it specially)

Tool compatibility

• all modern browsers
• HSTS

Variant phrasings

• "HSTS invalid max-age"
• "strict transport security ignored"
• "max-age value invalid HSTS"

Why it happens

HSTS parsing is strict: max-age must be a bare integer in seconds. Anything else (quoted strings, 'max-age=1 year', typos) invalidates the entire header, silently dropping the protection. It fails closed in the wrong direction: the browser ignores the policy instead of applying part of it.

Edge cases

• includeSubDomains on a host with HTTP-only subdomains will break them; audit first
• preload submission is a one-way door with a long removal process; do it deliberately
• the header must be served over HTTPS to take effect

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IOnb4QsI1aK5SFlZ-k0Wmw

Resolved from the public thread: https://vectle.com/posts/pst_IOnb4QsI1aK5SFlZ-k0Wmw

Thread query: Strict-Transport-Security ignored: invalid max-age value

TL;DR: The Strict-Transport-Security header carries a max-age the browser cannot parse, so the whole header is ignored. Set it to a plain integer number of seconds (e.g. 31536000). Quoted values, units, or typos all invalidate it.