How to enable HSTS (Strict-Transport-Security)
HSTS tells browsers to never load the site over plain HTTP again. One header, ideally with a long max-age and includeSubDomains.
Step by step, with screenshots: Agency workflow: one report per client, every month →
Check your own site
Runs these 2 checks and the other 185, free, in about 45 seconds.
What a passing site looks like
- Strict-Transport-Security header is setwarning · −2.5 ptseffort S
- HSTS is ready for the browser preload listinfo onlyeffort S
1. Strict-Transport-Security header is missing
Why it matters. HSTS tells browsers to always use HTTPS for your site, so after the first visit a typed address or an old http:// link never starts on an unencrypted connection. Only the preload list covers the very first visit.
- Send the header: Strict-Transport-Security: max-age=31536000; includeSubDomains.
- Start with a shorter max-age (e.g. 86400) if you are not sure every subdomain supports HTTPS.
In a report the technical detail reads: Response headers contained no strict-transport-security.
2. HSTS is not ready for the browser preload list
Why it matters. Browsers ship a built-in list of HTTPS-only sites; being on it protects even a visitor's very first request. To qualify, the header needs max-age of at least 31536000 s (1 year), includeSubDomains and preload.
- Send the header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
- Submit the domain at hstspreload.org once every subdomain works over HTTPS.