vercel · kodiakhq · Jan 26, 2022 · Jan 26, 2022 · Jan 26, 2022 · Jan 26, 2022
diff --git a/docs/advanced-features/security-headers.md b/docs/advanced-features/security-headers.md
@@ -43,7 +43,7 @@ This header controls DNS prefetching, allowing browsers to proactively perform d
 
 This header informs browsers it should only be accessed using HTTPS, instead of using HTTP. Using the configuration below, all present and future subdomains will use HTTPS for a `max-age` of 2 years. This blocks access to pages or subdomains that can only be served over HTTP.
 
-If you're deploying to [Vercel](https://vercel.com/docs/edge-network/headers#strict-transport-security), this header is not necessary as it's automatically added to all deployments.
+If you're deploying to [Vercel](https://vercel.com/docs/edge-network/headers#strict-transport-security), this header is not necessary as it's automatically added to all deployments unless you declare [`headers`](https://nextjs.org/docs/api-reference/next.config.js/headers) in your `next.config.js`.
 
 ```jsx
 {
-Original file line number
+Diff line change
@@ Expand Up @@
     This header informs browsers it should only be accessed using HTTPS, instead of using HTTP. Using the configuration below, all present and future subdomains will use HTTPS for a `max-age` of 2 years. This blocks access to pages or subdomains that can only be served over HTTP.
-    If you're deploying to [Vercel](https://vercel.com/docs/edge-network/headers#strict-transport-security), this header is not necessary as it's automatically added to all deployments.
+    If you're deploying to [Vercel](https://vercel.com/docs/edge-network/headers#strict-transport-security), this header is not necessary as it's automatically added to all deployments unless you declare [`headers`](https://nextjs.org/docs/api-reference/next.config.js/headers) in your `next.config.js`.
     ```jsx
     {
@@ Expand Down @@