max-age=0 tells browsers to forget the HSTS policy.

HSTS_MAX_AGE_ZERO · Severity: Warning

• WarningHSTS_MAX_AGE_ZERO

  max-age=0 tells browsers to forget the HSTS policy.

  A max-age of zero deletes any stored HSTS policy for the host (RFC 6797 section 6.1.1). That is the documented way to switch HSTS off, not a short policy.

Reported by

• HSTS header parser

Available through the API

• HSTS header parser API

Related findings

• Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
• Error HSTS_INVALID Browsers ignore this Strict-Transport-Security value.
• Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.
• Info HSTS_NO_INCLUDE_SUBDOMAINS The HSTS policy does not cover subdomains.
• Warning HSTS_PRELOAD_NOT_ELIGIBLE The value asks for preloading but does not meet the preload list's rules.
• Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

All findings