No HSTS header

Audit check hsts · worth 4 of 100 points · all checks

What the audit saw

Strict-Transport-Security is absent, so a first visit over http is still possible.

Why it costs you

HSTS tells the browser to refuse plain http for this host for a set period, which closes the window where a first request can be intercepted and downgraded.

How to find it on your site

  1. Check 
    curl -sSI https://your-site.com/ | grep -i strict-transport-security
  2. Add it, short max-age first 
    add_header Strict-Transport-Security "max-age=86400; includeSubDomains" always;
# raise to 31536000 once you are sure every subdomain is https
  3. Then consider preload, last 
    # https://hstspreload.org/ — permanent, and removal takes months.
# max-age=63072000; includeSubDomains; preload

How to know it is fixed

strict-transport-security present with max-age at least 86400.

The part people get wrong

HSTS with includeSubDomains on a domain that still has one http-only subdomain will break that subdomain for every returning visitor. Raise the age slowly.

Check it against your own site

Open an issue with your URL and a bot runs this check plus 14 others, posts the failures with the measured values, and publishes a report page: free audit. If you want the fixes applied and re-verified instead: fixed-price tiers.

Other checks

The site does not answer on the URL you gave · The page is served over plain HTTP · The TLS certificate is expired or about to exp · No mobile viewport tag · The page title is missing or the wrong length · The meta description is missing or the wrong l · The page has no H1, or more than one · Images have no alt text

All published audits · Check reference