Skip to content

Security

How to add a Strict-Transport-Security header

Without HSTS, the first request a browser makes to your domain can still go over plain HTTP, where it can be intercepted and redirected before your redirect ever runs. A short max-age means browsers forget the rule quickly, so a returning visitor can be downgraded again.

What 13x checks

This is rule security.hsts in the public registry: Strict-Transport-Security is set. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Security
Score weight
8 of the readiness score
Scope
Runs on every audited page
Applies
Only where the market or the page shape makes it relevant

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

Add the HSTS header:

Configuration
Strict-Transport-Security: max-age=63072000; includeSubDomains

Add it only after you are certain HTTPS works on the apex and every subdomain. Browsers cache the rule for the full max-age and there is no way to reach a subdomain over HTTP once it is set — including one you set up later.

Roll it out in stages: max-age=300 for a day, then max-age=604800 for a week, then two years. Add preload and submit to hstspreload.org last; removal from the preload list takes months.

Framework-specific versions

Where the change differs enough to be worth writing out separately.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More security checks