Security check
HSTS
Reads the Strict-Transport-Security response header and its max-age.
- Category
- Security
- Importance
- Medium importance
- Check id
- hsts
How the result is decided
- Passmax-age of at least 180 days (15,552,000 seconds).
- WarningNo HSTS header, or a shorter max-age.
- InfoThe page isn’t on HTTPS, so HSTS doesn’t apply.
“Info” results don’t count toward the score.
Why it matters
HSTS tells browsers to always use HTTPS for your site, so a visitor can’t be downgraded to an insecure connection.
How to fix it
Strict-Transport-Security: max-age=31536000; includeSubDomains- Nginx:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - Apache:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" - Cloudflare: SSL/TLS → Edge Certificates → HTTP Strict Transport Security.
- Only add includeSubDomains when every subdomain works over HTTPS.
After the fix, open the page’s report and choose Run again to confirm it passes.