HSTS missing from HTTPS server

If a scan reports "HSTS missing from HTTPS server", an HTTPS response from your site came back without a Strict-Transport-Security header. That header tells a browser to use only HTTPS for your host for the next max-age seconds. Without it, a visitor who types your address or follows an old http:// link starts on plain http until your redirect sends them to HTTPS.

Send it on every HTTPS response

Set the header with a max-age greater than 0 in the app, the web server, or the CDN:

Strict-Transport-Security: max-age=31536000

Then check the https:// address of the same page. Browsers ignore the header on a plain http response. RFC 6797 says a browser "MUST ignore" one that arrives over insecure transport. A header sent only from your http:// redirect does nothing.

A header with max-age=0 does more harm than a missing one. The standard says it tells a browser to forget your HSTS policy. A release that changes one year to zero turns HSTS off in each browser that loads the page.

How we check it

Add a Security Headers monitor for https://shop.example.com/. A new monitor ticks HSTS enabled. This assertion holds when the HTTPS response carries the header with a max-age above 0. A release that removes the header breaks it. So does one that makes this change:

Before: max-age=31536000; includeSubDomains
After:  max-age=0; includeSubDomains

We alert only when an assertion you've ticked breaks or recovers.

What the check misses

We read one page per monitor. Another page or host can still lack the header. HSTS enabled checks only that max-age is above 0. It doesn't judge how long the policy lasts or whether it covers subdomains.