diff --git a/playbooks/web.yml b/playbooks/web.yml
index 5b2c1c7..e6b66d4 100755
--- a/playbooks/web.yml
+++ b/playbooks/web.yml
@@ -16,6 +16,7 @@
         apache_remove_default_vhost: yes
         apache_packages_state: latest
         apache_mods_enabled:
+          - headers.load
           - ssl.load
           - proxy.load
           - proxy_http.load
@@ -32,6 +33,8 @@
               Redirect permanent / https://git.desu.ltd
         apache_vhosts_ssl:
           - servername: nc.desu.ltd
+            extra_parameters: |
+              Header always set Strict-Transport-Security "max-age=31536000"
             documentroot: /var/www/nc.desu.ltd
             certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
             certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem