The HTTPS site sends no valid Strict-Transport-Security header.

HSTS_MISSING · Severity: Warning

• WarningHSTS_MISSING

  The HTTPS site sends no valid Strict-Transport-Security header.

  HSTS (RFC 6797) tells browsers to use only HTTPS for the domain for max-age seconds, so a later visit cannot be downgraded to plain HTTP. A header without a valid max-age, or with a directive repeated, is ignored by browsers and counts as missing.

  Recommendation: Send Strict-Transport-Security with max-age=31536000 on HTTPS responses, after checking that every subdomain you cover works over HTTPS.

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

Related findings

• Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.
• Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

All findings