Missing HSTS header

MediumAuto-fixableSecurityPer-page checksecurity_no_hsts

What this means

An HTTPS response sends no Strict-Transport-Security header, so a browser will still attempt the HTTP version first and can be downgraded.

How to fix it

Send Strict-Transport-Security: max-age=31536000; includeSubDomains once you are confident every subdomain serves HTTPS.

Fix effort

This check is auto-fixable: the change can be written and validated automatically, so CrawlX can open it as a pull request for review.

Authoritative source

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

Related checks

More in Security

Redirect downgrades HTTPS to HTTP Mixed content on an HTTPS page Content-Security-Policy is report-only Missing Content-Security-Policy header Page not served over HTTPS All checks

Find every page this affects

CrawlX runs this check — and 161 others — across your whole site, ranks the findings by estimated impact, and opens the fixable ones as pull requests. Free for 500 URLs.

Start crawling free Browse all checks