Medium impactSecurity
Missing HSTS Header
Without HSTS, users can be downgraded to HTTP on first visit. Here's how to add it safely.
What it means
The Strict-Transport-Security HTTP response header tells browsers to always use HTTPS for your domain.
Why it matters
Without HSTS, a man-in-the-middle attacker can intercept the first HTTP request before redirect. HSTS also slightly improves performance by skipping a redirect hop.
How to fix it
- Add 'Strict-Transport-Security: max-age=31536000; includeSubDomains' to all HTTPS responses.
- Once stable, add 'preload' and submit to hstspreload.org.
- Verify with securityheaders.com.
Example
Before
<!-- no Strict-Transport-Security header -->After
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadFind this issue on your site automatically
FreeSEO scans for missing hsts header and 140+ other issues, free, no signup.
Frequently asked questions
Will HSTS break anything?
Only if you go back to HTTP, once a browser receives HSTS, it refuses HTTP for max-age seconds.