title: URL Rewrite for HSTS
body: <p>I am trying to write HSTS rewrite rules in the &lt;system.webServer&gt; section of the web.config file</p>
  <pre><code>&lt;rewrite&gt;
        &lt;rules&gt;
          &lt;rule name=&quot;HTTP to HTTPS redirect&quot; enabled=&quot;true&quot; stopProcessing=&quot;true&quot;&gt;
            &lt;match url=&quot;(.*)&quot; /&gt;
            &lt;conditions&gt;
              &lt;add input=&quot;{HTTPS}&quot; pattern=&quot;^test\.test\.test$&quot; ignoreCase=&quot;true&quot; /&gt;
            &lt;/conditions&gt;
            &lt;action type=&quot;Redirect&quot; url=&quot;https://test.test.test/{R:1}&quot;
                redirectType=&quot;Permanent&quot; /&gt;
          &lt;/rule&gt;
        &lt;/rules&gt; 
        &lt;outboundRules&gt;
          &lt;rule name=&quot;Add Strict-Transport-Security when HTTPS&quot; enabled=&quot;true&quot;&gt;
            &lt;match serverVariable=&quot;RESPONSE_Strict_Transport_Security&quot; pattern=&quot;.*&quot; /&gt;
            &lt;conditions&gt;
              &lt;add input=&quot;{HTTPS}&quot; pattern=&quot;on&quot; ignoreCase=&quot;true&quot; /&gt;
            &lt;/conditions&gt;
            &lt;action type=&quot;Rewrite&quot;  value=&quot;max-age=31536000; includeSubDomains; preload&quot;  /&gt;
          &lt;/rule&gt;
        &lt;/outboundRules&gt;
  &lt;/rewrite&gt; 
  </code></pre>
  <p>I can see these redirect and rewrite rules in IIS but not sure why Strict-Transport-Security header is not present while checking via Dev tools F12 also the website is fully functional</p>
  <p>I know there is another way to add custom headers in web.config but by looking into couples of posts here on SO, it doesn't look like a recommended approach.</p>
  <p>Can anyone tell me what wrong am I doing here ?</p>