What does the HSTS header do?

Strict-Transport-Security tells browsers to only ever connect to your site over HTTPS for a set period. After the first visit, the browser upgrades every http:// link to https:// itself, so an attacker on the network can't quietly downgrade the visitor to an unencrypted connection.

What HSTS value should I use?

Strict-Transport-Security: max-age=31536000; includeSubDomains is the common setting, meaning one year, covering all subdomains. Start with a short max-age such as 300 seconds to test, and only add includeSubDomains if every subdomain works over HTTPS.

Can HSTS break my website?

Only if part of the site, or a subdomain covered by includeSubDomains, doesn't work over HTTPS. Browsers will then refuse to load it until max-age runs out. Test with a short max-age first.

Low to medium risk HTTPS · Website security header

Missing HSTS header: what it means and how to fix it

By Stephane Meus, CEH, PenTest+ · Updated 11 October 2026 · 5 minute read

Short answer: your website works over HTTPS but doesn't tell browsers to always use HTTPS. That leaves a gap where an attacker on the same network, such as public Wi-Fi, can push a visitor onto an unencrypted connection without them noticing.

The fix: add one response header to your website:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Test with a short max-age first (step 1 below). The settings for each web server are further down.

What is HSTS?

HSTS stands for HTTP Strict Transport Security. It's a header your site sends with each HTTPS page. When a browser sees it, the browser remembers to use HTTPS for your domain for the number of seconds in max-age. During that time it turns any http:// link or typed address into https:// before sending anything, and it won't let the visitor click past a certificate warning.

Redirecting HTTP to HTTPS is still needed, but a redirect alone has a weak spot. The first request goes out unencrypted, and an attacker in the middle can intercept it and keep the visitor on HTTP. This is called SSL stripping. HSTS closes that gap for every visit after the first.

How serious is it?

It's a hardening step, not an open door. FreshScanSentry rates it Low or Medium depending on which check found it. It matters most for sites with logins, checkouts, customer portals, or admin pages, where a stolen session or password causes real damage. It's also cheap to fix, and security reviews, cyber insurance questionnaires and PCI assessments often ask for it.

How it looks in your report shop.example.com

443 HTTPS Missing Strict-Transport-Security header Low

Found by the Deep Scan's web app checks

How to check your site

curl -sI https://your-site.com | grep -i strict-transport-security

No output means the header is missing. You can also open your browser's developer tools, go to the Network tab, reload, click the first request, and look under Response headers.

How to fix it

1. Make sure HTTPS works everywhere, then start small

Every page should load over HTTPS without warnings, and HTTP should redirect to HTTPS.
Start with max-age=300 (5 minutes) and no includeSubDomains. Browse the site, then raise it to a week, then a year (31536000).
Only add includeSubDomains once you've checked every subdomain works over HTTPS, including old ones like mail., intranet. or a printer's web page. Browsers will refuse to load any that don't.

2. Add the header

Apache (needs mod_headers: sudo a2enmod headers on Ubuntu or Debian). Put this in the HTTPS virtual host (<VirtualHost *:443>), then reload Apache:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

nginx. Put this in the server block that listens on 443, then reload nginx:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

In nginx, an add_header inside a location block replaces the ones from the server block. Repeat it there if a location sets its own headers.

IIS (Windows Server). IIS 10 version 1709 and later have built-in HSTS. In IIS Manager, select the site, open HSTS under Manage Website → Configure, enable it, and set Max-Age to 31536000. On older versions, add a custom response header named Strict-Transport-Security in HTTP Response Headers.

Cloudflare. In the dashboard go to SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS) and enable it. Cloudflare adds the header for you.

Node.js / Express. The helmet package sets it, along with other security headers:

const helmet = require('helmet');
app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true }));

Hosted website builders and WordPress hosts. Look for an "HSTS" or "security headers" setting in the hosting panel, or ask support. Many managed hosts add it on request.

3. Check it worked

Run the curl command again, or re-scan. The header should show your max-age. This site sends it too. Try it on https://freshscansentry.com.

4. Optional: HSTS preload

Browsers also ship with a built-in list of HSTS sites, which protects even the very first visit. To join it, use max-age=31536000; includeSubDomains; preload and submit your domain at hstspreload.org. Only do this when you're sure every subdomain will use HTTPS for good, because getting removed from the list takes months.

Common questions

I already redirect HTTP to HTTPS. Isn't that enough?

The redirect is still needed, but the first unencrypted request can be intercepted before the redirect happens. HSTS makes the browser skip that unencrypted request on later visits.

Should the header be sent on HTTP pages too?

No. Browsers ignore it on plain HTTP. Send it on HTTPS responses only, and keep the HTTP-to-HTTPS redirect.

What if I set it and need to go back?

Send max-age=0 over HTTPS. Browsers that visit again will forget the rule. Visitors who don't come back keep it until their old max-age runs out, which is why you start small.

Sources: RFC 6797 (HSTS) · MDN: Strict-Transport-Security · HSTS preload list · OWASP HSTS cheat sheet