Website · Fix guide
HSTS header missing
- HSTS
- HTTP Strict Transport Security
Browsers are not instructed to use HTTPS automatically on future visits.
What is HSTS?
HTTP Strict Transport Security is a response header that tells browsers to use HTTPS automatically for future visits. It reduces the chance of a visitor being downgraded to an insecure HTTP connection.
What to do next
- Confirm HTTPS works on the main domain and every subdomain that visitors need.
- Start with Strict-Transport-Security: max-age=300 on the final HTTPS response.
- After testing, increase max-age to 31536000. Add includeSubDomains only when every subdomain supports HTTPS, and use preload only after checking the preload requirements.
Useful links
How to verify the fix
Inspect the final HTTPS response, not an intermediate redirect, and confirm the header contains the intended max-age.
When this result may be wrong
The header is ignored over HTTP and may be added only by a CDN or production edge. HSTS can make an incorrectly configured subdomain inaccessible until max-age expires.
Ready to check again?
Check a domain
Run a fresh report after DNS caches and platform changes have had time to update.