Strict-Transport-Security (HSTS) header

Tells browsers to reach this site over HTTPS only, for a set time, so a downgrade never gets the chance. Counted as strong at a max-age of six months or more.

• Help center

HSTS (HTTP Strict Transport Security) tells the browser: for the next N seconds, open this site only over HTTPS. After the first visit, the browser rewrites any http:// link to https:// itself, before a request leaves the device. That closes the gap a redirect leaves open — the first unencrypted request, which an attacker on public Wi-Fi can intercept to strip HTTPS away. It also turns certificate warnings into hard errors that the visitor cannot click through.

How SiteScan grades it

The scanner reads the max-age value. Six months (15,552,000 seconds) or more is “Strong”; a shorter value is “Weak”, because protection lapses too quickly between visits. No header is “Missing”. The header only counts when sent over HTTPS — browsers ignore it on plain HTTP.

Recommended value

Strict-Transport-Security: max-age=31536000; includeSubDomains

Start with a short max-age (for example 300) if you are not sure every subdomain works over HTTPS, then raise it to a year. Add includeSubDomains only when all subdomains do, and preload only once you meet the preload list terms. Make sure the http → https redirect is in place too.