HSTS missing or too short
Checks the Strict-Transport-Security header (at least 180 days).
Recommended next step if found
Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses.
HTTP Strict Transport Security
HSTS tells supporting browsers to use HTTPS for a host within the policy’s lifetime. Changes need to account for the site and its subdomains.
Related public checks
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Keep the scope.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology