fix(nginx): remove HSTS from opt-in security headers to avoid duplicate

[ma-04]

The nginx-proxy edge layer in front of every FlyWP site already sends its own Strict-Transport-Security header unconditionally, regardless of the per-site security-headers toggle. Now that the add_header shadowing bug (35b254a) is fixed, sites with the toggle on also send their own HSTS from security-headers.conf, resulting in two Strict-Transport-Security headers in the response.

Drop HSTS from security-headers.conf since the edge already provides baseline HSTS to every site independent of the toggle; deduping at the edge is out of scope here since that's a separate system. The toggle continues to control CSP, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, and Referrer-Policy.

Summary by CodeRabbit

• Security
  • Removed the Strict-Transport-Security response header from web responses.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e28935ef-e559-4a7c-8263-78e9df147967

📥 Commits

Reviewing files that changed from the base of the PR and between 12ee53c and 97f38ef.

📒 Files selected for processing (1)

• nginx/common/security-headers.conf

💤 Files with no reviewable changes (1)

• nginx/common/security-headers.conf

---

Walkthrough

Removes the HSTS directive from the shared Nginx security headers configuration while preserving the remaining security headers.

Changes

Cohort / File(s)	Summary
Nginx security headers nginx/common/security-headers.conf	Removes the Strict-Transport-Security header directive; all other configured security headers remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• flywp/config#19: Modifies the same HSTS directive by adding the always option instead of removing it.

Poem

A rabbit hops past headers bright,
One HSTS leaf takes flight.
The other guards stay in their row,
While Nginx keeps its steady flow.
Carrot cheers for configs light! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing HSTS from nginx security headers to avoid duplicate headers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}