I am currently trying to find this header which was already set on a Laserfiche website by accident and I am getting a Page cannot be displayed when trying the link above.

After googling where headers are found in IIS I am checking under HTTP Response Headers but it is not there, am I in the right spot?

Thanks for pointing out the dead link. I've updated it with new ones.

HTTP response headers can be set either at the IIS level or by application code itself.

Within IIS, the HTTP Response Headers can be set at three different scopes: Server, Site, or Application. 

As of now, one Laserfiche web application, Forms, supports setting the HSTS header within the application config (/FormsConfig), from the Forms Server -> Security node, with the option to override the default header value (if enabled) under Advanced Options.

The Security node links to this docs page, which is for some reason unlisted in the Admin Guide table of contents, and mostly up to date: https://doc.laserfiche.com/laserfiche.documentation/11/administration/en-us/Default.htm#../Subsystems/Forms/Content/Administration/configuring-security-options.htm

HTTP Security Headers > "Enable the HTTP Strict-Transport-Security (HSTS) header"

Advanced Options > "SecurityStrictTransportSecurity" property with description "Define the HTTP Strict-Transport-Security (HSTS) header value."