如何禁止IP直接访问OneinStack - A PHP/JAVA Deployment Tool这个界面

Start your code hereserver {
 listen 80;
 listen 443 ssl http2;
 ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EE$
 ssl_prefer_server_ciphers on;
 ssl_session_timeout 10m;
 ssl_session_cache builtin:1000 shared:SSL:10m;
 ssl_buffer_size 1400;
 add_header Strict-Transport-Security max-age=15768000;
 ssl_stapling on;
 ssl_stapling_verify on;
 server_name domain.com www.domain.com;
 access_log /data/wwwlogs/domain.com_nginx.log combined;
 index index.html index.htm index.php;
 include /usr/local/nginx/conf/rewrite/wordpress.conf;
 root /data/wwwroot/domain.com;
if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
 #error_page 404 = /404.html;
 #error_page 502 = /502.html;
 if ($host != domian.com) {
 rewrite ^/(.*)$ $scheme://domain.com/$1 permanent;
 }

 location ~ [^/]\.php(/|$) {
 #fastcgi_pass remote_php_ip:9000;
 fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
 include fastcgi.conf;
 }
 location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
 expires 30d;
 access_log off;
 }
 location ~ .*\.(js|css)?$ {
 expires 7d;
 access_log off;
 }
 location ~ .*\.(js|css)?$ {
 expires 7d;
 access_log off;
 }
 location ~ /\.ht {
 deny all;
 }
}

其中有一句是这样，

add_header Strict-Transport-Security max-age=15768000;

但是去添加HSTS Preload的时候提示错误。
 
Error: No includeSubDomains directiveThe header must contain the `includeSubDomains` directive.
Error: No preload directiveThe header must contain the `preload` directive.
Warning: Unnecessary HSTS header over HTTPThe HTTP page at http://domain.com sends an HSTS header. This has no effect over HTTP, and should be removed.
 
请问这个问题怎么解决。
 
感谢。