The value asks for preloading but does not meet the preload list's rules.

HSTS_PRELOAD_NOT_ELIGIBLE · Severity: Warning

• WarningHSTS_PRELOAD_NOT_ELIGIBLE

  The value asks for preloading but does not meet the preload list's rules.

  hstspreload.org accepts a domain only with max-age of at least 31536000, includeSubDomains and preload. The value has the preload directive but misses what the evidence lists, so a submission is refused.

  Recommendation: Add what is missing, or remove the preload directive.

Reported by

• HSTS header parser

Available through the API

• HSTS header parser API

Related findings

• Error HSTS_INVALID Browsers ignore this Strict-Transport-Security value.
• Warning HSTS_MAX_AGE_ZERO max-age=0 tells browsers to forget the HSTS policy.
• Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
• Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.
• Info HSTS_NO_INCLUDE_SUBDOMAINS The HSTS policy does not cover subdomains.
• Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

All findings