Matan · Security · Transport

HSTS

Strict-Transport-Security tells browsers to skip HTTP entirely on future visits.

Pass condition in our engine: HSTS is present with max-age ≥ 15552000 seconds.

1. Problem description

Without HSTS, users (and some tools) can still be served a first HTTP request — an SSL-stripping window. We look for max-age of at least six months. includeSubDomains and preload are recommended once you are sure every subdomain speaks HTTPS.

2. Most common causes

  • TLS is on but the header was never configured.
  • max-age=0 leftover from a migration.
  • Header only on the homepage, not this path (we read this response).

3. How to fix it

  1. Send Strict-Transport-Security: max-age=15552000; includeSubDomains (and preload when ready).
  2. Do not enable preload until all subdomains are HTTPS.
  3. Set the header at the CDN so every path inherits it.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free SEO & GEO report

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Generate a free reportView sample report