Check a site for HSTS (Strict-Transport-Security)
HSTS is a single response header, Strict-Transport-Security, that tells browsers to reach a site over HTTPS only and refuse any downgrade to plain HTTP. Without it, a first visit or a stray http:// link leaves a window for a downgrade or interception attack, even on a site that otherwise runs HTTPS.
What it costs
On CheckWeb this is a weight-2 check on the Security axis (35% of the overall score), and a missing header shows as a warning rather than a hard fail: the encryption is present, but nothing enforces it. HTTPS with a valid certificate and no HSTS is a common half-measure. The fix is one line.
How it looks in the report
Under the Security axis, this shows as "HSTS (Strict-Transport-Security)" with a WARN status and the evidence "No Strict-Transport-Security header" when absent. A site that sends it shows PASS.
HSTS (Strict-Transport-Security)
No Strict-Transport-Security header
Missing vs set
Missing
The first request over http:// can be intercepted or downgraded before the redirect to https:// ever happens.
Set
`Strict-Transport-Security: max-age=31536000; includeSubDomains` locks the browser to HTTPS for a year, subdomains included.
How to fix it
- Add one response header: `Strict-Transport-Security: max-age=31536000; includeSubDomains`.
- Nginx `add_header`, Apache `Header always set`, or app middleware: any layer that sets response headers works.
- Ship a short max-age first, confirm nothing breaks on subdomains, then raise it. Add `preload` only once ready to commit, since preload is hard to undo.
- Then verify: re-scan.
Check a site for HSTS
Paste a URL to see whether a site enforces HTTPS with HSTS, and the exact header to add if not. Fix, re-scan, confirm.
Check my website