The domain does not meet the HSTS preload requirements.

HSTS_NOT_PRELOAD_READY · Severity: Info

• InfoHSTS_NOT_PRELOAD_READY

  The domain does not meet the HSTS preload requirements.

  hstspreload.org requires max-age of at least 31536000, includeSubDomains, the preload directive and, when port 80 answers, a redirect from HTTP to HTTPS on the same host. The evidence lists what is missing. Preloading is optional and hard to undo.

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

Related findings

• Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
• Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

All findings