Check a site for HSTS (Strict-Transport-Security)
HSTS is a single response header, Strict-Transport-Security, that tells browsers to reach a site over HTTPS only and refuse any downgrade to plain HTTP. Without it, a first visit or a stray http:// link leaves a window for a downgrade or interception attack, even on a site that otherwise runs HTTPS.
What it costs
On CheckWeb this is a weight-2 check on the Security axis (35% of the overall score), and a missing header shows as a warning rather than a hard fail: the encryption is present, but nothing enforces it. HTTPS with a valid certificate and no HSTS is a common half-measure. The fix is one line.
How it looks in the report
Under the Security axis, this shows as "HSTS (Strict-Transport-Security)" with a WARN status and the evidence "No Strict-Transport-Security header" when absent. A site that sends it shows PASS.
HSTS (Strict-Transport-Security)
No Strict-Transport-Security header
Missing vs set
Missing
The first request over http:// can be intercepted or downgraded before the redirect to https:// ever happens.
Set
`Strict-Transport-Security: max-age=31536000; includeSubDomains` locks the browser to HTTPS for a year, subdomains included.
How to fix it
- Add one response header: `Strict-Transport-Security: max-age=31536000; includeSubDomains`.
- Nginx `add_header`, Apache `Header always set`, or app middleware: any layer that sets response headers works.
- Ship a short max-age first, confirm nothing breaks on subdomains, then raise it. Add `preload` only once ready to commit, since preload is hard to undo.
- Then verify: re-scan.
Check a site for HSTS
Paste a URL to see whether a site enforces HTTPS with HSTS, and the exact header to add if not. Fix, re-scan, confirm.
Check my websiteFAQ
- What max-age should HSTS use?
- One year, written as max-age=31536000, is the usual production value and the one the report recommends. Shorter values are for the rollout only: starting at a few minutes, then hours, then days makes it cheap to back out while the site is still being verified over HTTPS.
- Does the check require includeSubDomains or preload?
- No. The check passes on a Strict-Transport-Security header carrying a max-age, because that is the part that stops the downgrade. includeSubDomains and preload are stronger, and both are worth adding once every subdomain is confirmed to serve HTTPS, but neither is required to clear the check.
- What breaks if HSTS is enabled too early?
- Any hostname covered by the header that is not fully served over HTTPS becomes unreachable for the length of max-age, and browsers honour that locally regardless of what the server does afterwards. The order that avoids this: serve HTTPS everywhere, add the HTTP to HTTPS redirect, confirm both, then set HSTS with a short max-age and raise it.
- How is HSTS undone if it was set by mistake?
- Send the header with max-age=0 and keep serving it over HTTPS until every browser that saw the old value has revisited. There is no way to expire it remotely faster than that, which is the reason for raising max-age gradually rather than starting at a year.