title: How to set HSTS header from .htaccess only on HTTPS
body: <p>My web application runs on a different number of hosts that I control. To prevent the need to change the Apache config of each vhost, I add most of the config using .htaccess files in my repo so the basic setup of each host is just a couple of lines. This also makes it possible to change the config upon deploying a new version. Currently the .htaccess (un)sets headers, does some rewrite magic and controls the caching of the UA.</p>
  <p>I want to enable HSTS in the application using .htaccess. Just setting the header is easy:</p>
  <pre><code>Header always set Strict-Transport-Security &quot;max-age=31536000&quot;
  </code></pre>
  <p>But the spec clearly states: &quot;An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.&quot;. So I don't want to send the header when sending it over HTTP connections. See <a href="https://datatracker.ietf.org/doc/html/draft-ietf-websec-strict-transport-sec-14" rel="nofollow noreferrer">https://datatracker.ietf.org/doc/html/draft-ietf-websec-strict-transport-sec-14</a> .</p>
  <p>I tried to set the header using environment vars, but I got stuck there. Anyone that knows how to do that?</p>