Security Headers Checker / Headers

Strict-Transport-Security (HSTS): force HTTPS in the browser

HSTS tells the browser to use HTTPS for this host for max-age seconds, even when someone types http:// or follows an old link, so the first request cannot be intercepted and downgraded. Browsers ignore it over plain HTTP and on a certificate error.

What to send

Strict-Transport-Security: max-age=31536000; includeSubDomains

Begin with max-age=300 for a day, then a week, then a year. Add includeSubDomains only when every subdomain serves HTTPS. preload (and submitting to hstspreload.org) is very hard to undo: add it last.

# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

How our grade counts it

• Coverage, up to 15 points: 15 for max-age of a year or more with includeSubDomains; 12 for a year without; 10 for six months to a year; 5 for less; 0 when ignored (HTTP, max-age=0, invalid certificate)
• Effectiveness, minus 5: HSTS without includeSubDomains, when max-age is under a year (with a year or more the coverage points say so: 12, not 15)
• Effectiveness, minus 5: HSTS preload directive without the preload requirements
• Effectiveness, minus 10: HTTP does not redirect to HTTPS
• Effectiveness, minus 5: The first redirect from HTTP leaves the host (HSTS never set for it)

The full grading rules

Common mistakes

• Sending HSTS over plain HTTP only: browsers ignore it there.
• max-age=0 (it deletes HSTS) or a few seconds.
• includeSubDomains while an internal or legacy subdomain is still HTTP-only: it stops loading.
• Redirecting http://example.com to another host first: HSTS is never set for the host the visitor typed.

Strict-Transport-Security on MDN