diff --git a/apache/files/_ssl.conf b/apache/files/_ssl.conf
index 5eefcbc..5007ec7 100644
--- a/apache/files/_ssl.conf
+++ b/apache/files/_ssl.conf
@@ -5,6 +5,11 @@
   SSLCertificateFile /etc/ssl/certs/{{ site.host.name }}.crt
   SSLCertificateKeyFile /etc/ssl/private/{{ site.host.name }}.key
   SSLCertificateChainFile /etc/ssl/certs/ca-chain.crt
+
+  {%- if site.ssl.get('forward_secrecy', False) %}
+  Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
+  {%- endif %}
+
   {%- set ssl_mode = site.ssl.get('mode', 'secure') %}
   {%- include "apache/files/_ssl_"+ssl_mode+".conf" %}
   {%- endif %}