CHECK GLOSSARY · HSTS-001

No HSTS header

In plain words: HSTS tells browsers to always use https, preventing downgrade attacks.

How to fix it

Send Strict-Transport-Security once https works everywhere.

Official sources

• MDN: HSTS

Related checks

• HTTPS-001: Site not served over HTTPS
• HTTPS-002: http does not redirect to https
• TLS-001: Certificate problem or near expiry
• TLS-002: Outdated TLS version

Check my site free → All checks