diff --git a/backend/templates/_hsts.conf b/backend/templates/_hsts.conf
index 26c83ee8b..0e9829009 100644
--- a/backend/templates/_hsts.conf
+++ b/backend/templates/_hsts.conf
@@ -2,7 +2,11 @@
 {% if ssl_forced == 1 or ssl_forced == true %}
 {% if hsts_enabled == 1 or hsts_enabled == true %}
   # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
-  add_header Strict-Transport-Security $hsts_header always;
+{% if hsts_subdomains == 1 or hsts_subdomains == true %}
+  add_header Strict-Transport-Security $hsts_header_subdomains always;
+{% else %}
+  add_header Strict-Transport-Security $hsts_header_plain always;
+{% endif %}
 {% endif %}
 {% endif %}
 {% endif %}
diff --git a/backend/templates/_hsts_map.conf b/backend/templates/_hsts_map.conf
index 27dd1f8f4..f9f3339ef 100644
--- a/backend/templates/_hsts_map.conf
+++ b/backend/templates/_hsts_map.conf
@@ -1,3 +1,6 @@
-map $scheme $hsts_header {
-    https   "max-age=63072000;{% if hsts_subdomains == 1 or hsts_subdomains == true -%} includeSubDomains;{% endif %} preload";
+map $scheme $hsts_header_plain {
+    https   "max-age=63072000; preload";
+}
+map $scheme $hsts_header_subdomains {
+    https   "max-age=63072000;includeSubDomains; preload";
 }
\ No newline at end of file