Skip to content
DomainGrade

What we checkCertificate & HTTPSTL-07

Your site does not send HSTS

The first request of a visitor's session can still go out over plain HTTP.

Area
Certificate & HTTPS
Check
TL-07
Included
Free in every scan

What we check

No Strict-Transport-Security header was present on your HTTPS response.

Why it matters

A redirect from HTTP to HTTPS still means the first request travelled in the clear — and that request is the one an attacker on the same network is waiting for.

HSTS closes the gap: once a browser has seen it, it rewrites the URL itself before anything is sent.

Without it, an attacker on the same network can also strip the redirect entirely and serve their own copy of your site over plain HTTP. The visitor sees your content at your address, with no warning that anything is wrong.

How to fix it

  1. 1

    Send the header on every HTTPS response.

  2. 2

    Start with a short max-age, confirm nothing on your domain needs plain HTTP, then raise it to a year.

A response header
Strict-Transport-Security: max-age=31536000; includeSubDomains

Common questions

I already redirect HTTP to HTTPS.
Good, and necessary — but the redirect itself is the plain-HTTP request. HSTS is what removes it from the second visit onward.
What if I am not ready for a year?
Start at max-age=300. It is a real improvement and takes five minutes to undo.
Should I add includeSubDomains immediately?
Only once you are sure no subdomain needs plain HTTP. It is not easily reversible.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other certificate & https checks