What we check/Certificate & HTTPSTL-07

HSTS

Strict-Transport-Security tells browsers to use HTTPS for your domain from now on, without asking.

Area

Certificate & HTTPS

Check

TL-07

Included

Free in every scan

What we check

We read the Strict-Transport-Security header from your HTTPS response and parse its directives.

Why it matters

Even with a redirect in place, the very first request of a session can go out over plain HTTP — and that is the request an attacker on the same network wants.

HSTS closes that window: once a browser has seen the header, it rewrites http:// to https:// itself before anything leaves the machine.

The header also protects against an active downgrade. Without it, an attacker on the same network can strip the redirect and serve their own copy of your site over plain HTTP; with it, the browser refuses to make the request at all.

How to fix it

1. 1

   Send the header on every HTTPS response.

2. 2

   Start with a short max-age while you confirm nothing on your domain needs plain HTTP, then raise it to a year.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Common questions

What max-age should I use?

31536000 — one year. Anything under six months is treated as weak, because the protection lapses too quickly for a returning visitor.

Is includeSubDomains risky?

It applies HSTS to every subdomain, including ones you may have forgotten. That is the point, but check that no internal subdomain relies on plain HTTP first.

Can I undo HSTS?

Only slowly: browsers remember it for the max-age you sent. Set max-age=0 and wait for it to expire everywhere. This is why you start short.