Browsers ignore this Strict-Transport-Security value.

HSTS_INVALID · Severity: Error

• ErrorHSTS_INVALID

  Browsers ignore this Strict-Transport-Security value.

  RFC 6797 requires a max-age directive with a number of seconds and forbids repeating a directive. A value that breaks either rule is ignored as a whole, so the site gets no HSTS protection. The evidence says which rule is broken.

  Recommendation: Send one max-age directive, for example max-age=31536000.

Reported by

• HSTS header parser

Available through the API

• HSTS header parser API

Related findings

• Warning HSTS_MAX_AGE_ZERO max-age=0 tells browsers to forget the HSTS policy.
• Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
• Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.
• Info HSTS_NO_INCLUDE_SUBDOMAINS The HSTS policy does not cover subdomains.
• Warning HSTS_PRELOAD_NOT_ELIGIBLE The value asks for preloading but does not meet the preload list's rules.
• Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

All findings