HSTS header
HSTS tells the browser: "This site must ALWAYS be visited over HTTPS, never HTTP". The browser remembers this and blocks any unsecured acces…
Analyse my site for freeUnderstanding "HSTS header"
HSTS (HTTP Strict Transport Security) is an HTTP header that instructs the browser to only access the site over HTTPS, even if the user types http:// or clicks an HTTP link. The browser memorises this instruction for the duration specified by the max-age parameter (in seconds). On all subsequent visits, the browser converts HTTP → HTTPS locally, before even sending the request to the network.
Without HSTS, even with a 301 redirect configured on the server, a visitor's very first request is sent in HTTP before being redirected. This first request is vulnerable to an SSL stripping attack, where an attacker intercepts the HTTP connection and presents a fake unencrypted version of the site.
How TheSiteFuse checks "HSTS header"
TheSiteFuse retrieves the HTTP response headers from the homepage (over HTTPS) and looks for the Strict-Transport-Security header. The check verifies the header is present and that the max-age value is long enough (minimum 1 month recommended, 1 year ideal). The presence of includeSubDomains is noted but not required for the check to pass.
Why "HSTS header" matters
Without HSTS, your site remains vulnerable even with HTTPS enabled and a 301 redirect configured:
- SSL stripping attack — an attacker between the visitor and your server can intercept the initial HTTP request and maintain an unencrypted connection, presenting a plaintext version of the site without the visitor realising it.
- Redirect bypass — if a user types
http://yoursite.comdirectly, their initial request travels in plaintext before being redirected. - Cookie exposure — without HSTS, an attacker can force an HTTP request to your domain, capturing any cookies not marked
Secure.
Fix "HSTS header" step by step
Apache
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Recommended max-age values
max-age=86400— 1 day (initial test)max-age=604800— 1 week (progressive rollout)max-age=31536000— 1 year (recommended production)
Warning: start with 1 day and increase progressively.
Verify
curl -I https://yoursite.com | grep -i strict
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — HSTS headerDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.