Matan · Security · Transport
HSTS (Security)
Strict-Transport-Security tells browsers to skip HTTP entirely on future visits.
Pass condition in our engine: HSTS is present with max-age ≥ 15552000 seconds.
This Security check is part of SEO-GEO scoring 2.2.1, last updated 2026-09-18. About 90 percent of the evaluation runs on the HTML we crawl, so you can verify the same pass condition with a free report.
1. Problem description
Without HSTS, users (and some tools) can still be served a first HTTP request — an SSL-stripping window. We look for max-age of at least six months. includeSubDomains and preload are recommended once you are sure every subdomain speaks HTTPS.
2. Most common causes
- TLS is on but the header was never configured.
- max-age=0 leftover from a migration.
- Header only on the homepage, not this path (we read this response).
3. How to fix it
- Send Strict-Transport-Security: max-age=15552000; includeSubDomains (and preload when ready).
- Do not enable preload until all subdomains are HTTPS.
- Set the header at the CDN so every path inherits it.
Test this check
We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.
Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.
Get your free website audit
Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.