Security headers check
Strict Transport Security is set
The Strict-Transport-Security header is present with a max-age of at least six months.
medium severitysec.hsts
Run this check on your site
Runs just this check in quick mode. The report opens with the evidence and the fix.
Why it matters
HSTS tells browsers to use HTTPS for the site from the first visit, which removes the window where an attacker can downgrade the connection.
How to fix it
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once HTTPS works everywhere on the domain.
The details
- Category
- Security headers
- Severity of a failure
- medium
- Confidence
- high
- Needs a browser
- No
- Check id
- sec.hsts
References
Free tools that run this check
Security Headers CheckerSecurity headers tell browsers to stay on HTTPS, refuse to be framed, stop guessing content types and limit what scripts may do. Check which ones your site sends and how they are set.SSL and HTTPS CheckerA trusted certificate is only part of HTTPS. Check that the handshake succeeds, that http redirects to https, that HSTS keeps browsers on https and that no resource is loaded insecurely.