The HSTS max-age is shorter than one year.

HSTS_SHORT_MAX_AGE · Severity: Info

• InfoHSTS_SHORT_MAX_AGE

  The HSTS max-age is shorter than one year.

  A short max-age is a sensible way to start with HSTS. Once HTTPS works everywhere, one year (31536000 seconds) or more is the usual value and is required for the preload list.

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

Related findings

• Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
• Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.

All findings