title: Can't enable HSTS on Django Application
body: <p>I've been working on a Django web application and I'm trying to increase its security level from <strong>A</strong> to <strong>A+</strong> on the SecurityHeaders website (<a href="https://securityheaders.com/" rel="nofollow noreferrer">https://securityheaders.com/</a>). The only thing I seem to miss is the &quot;Strict Transport Security&quot; header. That's the only reason I get an <strong>A</strong>.</p>
  <p>I saw that the HSTS Headers can be easily added in Django using some settings parameters. After reading some stuff online, I added these lines of code in my <code>settings.py</code>:</p>
  <pre><code>SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
  SECURE_HSTS_SECONDS = 60
  SECURE_HSTS_INCLUDE_SUBDOMAINS = True
  SECURE_HSTS_PRELOAD = True
  </code></pre>
  <p>(...) but when navigating on my site, I don't see the <code>Strict Transport Policy</code> header in the <strong>Response</strong> section (when pressing <code>F12</code>). This is how my <strong>Response</strong> looks like:</p>
  <pre><code>alt-svc: h3=&quot;:443&quot;; ma=86400, h3-29=&quot;:443&quot;; ma=86400, h3-28=&quot;:443&quot;; ma=86400, h3-27=&quot;:443&quot;; ma=86400
  cf-cache-status: DYNAMIC
  cf-ray: 6c9ba77f4c128bbd-FRA
  content-security-policy: default-src 'self' 'unsafe-inline'; img-src 'self' 'unsafe-inline' data:; connect-src 'unsafe-inline' *.fontawesome.com; object-src 'self' 'unsafe-inline'; font-src 'self' 'unsafe-inline' *.fontawesome.com fonts.gstatic.com; style-src 'self' 'unsafe-inline' *.fontawesome.com *.w3.org maxcdn.bootstrapcdn.com fonts.googleapis.com; script-src 'self' 'unsafe-inline' https://use.fontawesome.com https://kit.fontawesome.com *.jquery.com *.cloudflare.com *.jsdelivr.net
  content-type: text/html; charset=utf-8
  cross-origin-opener-policy: same-origin
  date: Fri, 07 Jan 2022 08:00:46 GMT
  expect-ct: max-age=604800, report-uri=&quot;https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct&quot;
  location: /
  nel: {&quot;success_fraction&quot;:0,&quot;report_to&quot;:&quot;cf-nel&quot;,&quot;max_age&quot;:604800}
  permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()
  referrer-policy: same-origin
  report-to: {&quot;endpoints&quot;:[{&quot;url&quot;:&quot;https:\/\/a.nel.cloudflare.com\/report\/v3?s=5HwVXKHhN2MPzsHX2fXmYa9buhsouaNmscXCB3ZW%2BEq7Mu3Kb1oJuxFHczmk88xonCtA4O16TZSb7elHC1A9PSoinUoYrFkM30LGOw%2FtyhDey%2BH7eUZaxm7x9b245wAiuEtT&quot;}],&quot;group&quot;:&quot;cf-nel&quot;,&quot;max_age&quot;:604800}
  server: cloudflare
  set-cookie: messages=W1siX19qc29uX21lc3NhZ2UiLDAsMjUsIlN1Y2Nlc3NmdWxseSBsb2dnZWQgaW4gYXMgbW1hdGVhcy4iXV0:1n5kB4:RbaPjJ-GtYjXfbxN-FmAh_CBl7h7QrAZXnQnXz5i3OQ; HttpOnly; Path=/; SameSite=Strict; Secure
  set-cookie: sessionid=xx5ycw43naakf2n2tm494nlquqbag7ux; expires=Fri, 21 Jan 2022 08:00:46 GMT; HttpOnly; Max-Age=1209600; Path=/; SameSite=Strict; Secure
  vary: Cookie
  via: 1.1 vegur
  x-content-type-options: nosniff
  x-frame-options: DENY
  </code></pre>
  <p>Basically, nothing happens. This is also enabled in <code>settings.py</code>:</p>
  <pre><code>'django.middleware.security.SecurityMiddleware',
  </code></pre>
  <p>(...) so it shouldn't be any problem, but it is.</p>
  <p>What can I do? Why can't I add HSTS Headers on my Django website?</p>