snag.page

Every check ยท HTTPS

HSTS

transport/hsts

What it checks

The Strict-Transport-Security header, and whether it lasts a year.

Why it matters

HSTS makes browsers go straight to https://, so the first request can't be intercepted.

How to fix it

  1. Send the header below with every https:// response.
  2. Once every subdomain works over HTTPS, add includeSubDomains and preload, and submit the domain at hstspreload.org.
Header
Strict-Transport-Security: max-age=31536000

Check a site for this and everything else: snag.page. More on https: HTTPS Redirect to HTTPS No downgrade www and the bare domain Certificate renewal