Strict-Transport-Security (HSTS) header

mediumsecurity-hsts

HSTS tells a browser to only ever connect over HTTPS. Here's what it protects against, and the exact header config to add it.

What it is

Strict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.

Once a browser has seen the header, it rewrites http:// requests to https:// itself, before any network request is sent — the redirect never has to happen over the wire.

Why it matters

Without HSTS, every visit that starts by typing a bare domain or following an http:// link makes one plaintext request before any redirect happens. That's the exact window an on-path attacker — a hostile Wi-Fi network, a compromised router — needs to intercept or downgrade the connection.

HSTS closes that window for anyone who has already visited once, and includeSubDomains extends the same protection to every subdomain without a separate header on each.

How to fix it

with a reference doc

nginx

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;

.htaccess

Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains"

next.config.js

async headers() {
  return [{
    source: '/(.*)',
    headers: [{ key: 'Strict-Transport-Security', value: 'max-age=15768000; includeSubDomains' }]
  }];
}

_headers

/*
  Strict-Transport-Security: max-age=15768000; includeSubDomains

Reference documentation

Related checks

criticalSSL certificate validityThis checks the TLS certificate a server presents on port 443: whether it has expired, whether it's about to, and whether the hostname being scanned actually appears in the certificate's subject or Subject Alternative Names.lowContent-Security-Policy headerContent-Security-Policy (CSP) is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources a page is allowed to load. Anything not on the allow-list is blocked before it runs, regardless of how it got onto the page.highMixed contentMixed content is any http:// resource — a script, stylesheet, image or iframe — loaded on a page served over https://. The page itself is encrypted; the mixed-content resource is not.mediumClickjacking protectionClickjacking protection stops another site from loading yours inside an invisible <iframe> and tricking a visitor into clicking something they didn't mean to. It's enforced with either the X-Frame-Options header or a Content-Security-Policy frame-ancestors directive.

This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.

What it is

Why it matters

How to fix it

Related checks

See whether your own site passes strict-transport-security (hsts) header.