HSTS enabled
HTTP Strict Transport Security (HSTS) tells browsers to only access your site over HTTPS, preventing protocol downgrade attacks and cookie hijacking.
Why It Matters
Without HSTS, attackers can intercept the initial HTTP request before it redirects to HTTPS, enabling man-in-the-middle attacks. HSTS ensures browsers never make insecure requests to your domain.
How We Check
We verify the presence of the Strict-Transport-Security header and check for proper max-age value (minimum 1 year recommended), includeSubDomains directive, and preload eligibility.
How to Fix
Add the header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Start with a short max-age and gradually increase it. Consider submitting to the HSTS preload list.
Related Security Checks
Related Tool
SSL Checker
Run all 10 related checks with our free ssl checker
Check Your Website Now
Run a free security scan to check for HSTS enabled issues and 58+ other security vulnerabilities.
Scan Your Website Free