Skip to content
Browse all guides

Issue #136 · important

Issue 136

What is this issue?

This issue checks whether your web server sends the Strict-Transport-Security (HSTS) HTTP response header when accessed over HTTPS.

What this issue checks

  • The HSTS header is present in HTTPS responses
  • The max-age directive is set to at least 31536000 seconds (1 year)
  • The header is not duplicated (browsers ignore duplicated HSTS headers)
  • The header is only sent over HTTPS connections (not HTTP)

What is considered a passing implementation

A passing implementation means:

  • The HSTS header is present in HTTPS responses
  • The max-age directive is at least 31536000 seconds (1 year)
  • The header is not duplicated
  • The header is only sent over HTTPS

Real-world example

A properly configured HSTS header looks like:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

This tells browsers to only connect to your site via HTTPS for the next year, including all subdomains, and indicates you want to be included in browser preload lists.

Why does it matter?

HSTS is critical for website security and indirectly affects SEO:

Crawlability

If your site is vulnerable to SSL stripping attacks, malicious actors could potentially manipulate your content or redirect crawlers to malicious pages, affecting your SEO.

Indexability

Similar to crawlability, security vulnerabilities can lead to indexing issues if crawlers are redirected to malicious or incorrect pages.

Rankings

While HSTS itself isn't a direct ranking factor, sites with strong security headers signal quality to search engines. Security is part of Google's page experience signals.

User Experience

HSTS protects users from man-in-the-middle attacks, particularly SSL stripping attacks where an attacker downgrades a connection from HTTPS to HTTP. Without HSTS, users clicking an http:// link can be silently redirected to an insecure connection.

AI Search / AEO

AI-powered search engines prioritize secure, trustworthy sites. HSTS demonstrates your commitment to security best practices.

SEO Health Score Impact

Resolving this issue improves your overall SEO health score by ensuring your site is protected against protocol downgrade attacks and that users always connect securely.

How to fix it

Follow these steps to implement HSTS properly:

Step 1: Ensure HTTPS is working correctly

Ensure HTTPS is working correctly on your site before enabling HSTS. Test that all pages load properly over HTTPS.

Step 2: Configure the HSTS header

Configure the HSTS header on your web server, CDN, or load balancer to send the header on all HTTPS responses:

Strict-Transport-Security: max-age=31536000

Step 3: Add includeSubDomains (optional)

Add includeSubDomains if all subdomains also support HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Step 4: Add preload directive (optional)

Add preload directive if you want to be included in browser HSTS preload lists (requires max-age of at least 31536000 and includeSubDomains):

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Step 5: Submit to HSTS preload list

Submit to HSTS preload list at hstspreload.org if you included the preload directive.

Step 6: Verify configuration

Verify configuration using online tools like Security Headers to ensure the header is properly set.

Step 7: Important - Only send over HTTPS

Only send the HSTS header over HTTPS connections, not HTTP. Browsers ignore HSTS headers sent over HTTP.

Examples

Example 1: Missing HSTS Header

Problem: The HSTS header is not present in HTTPS responses.

What fails:

HTTPS response does not include Strict-Transport-Security header

What passes:

Strict-Transport-Security: max-age=31536000

Example 2: Insufficient max-age Value

Problem: The max-age directive is set too low.

What fails:

Strict-Transport-Security: max-age=86400

What passes:

Strict-Transport-Security: max-age=31536000

Example 3: HSTS Header Sent Over HTTP

Problem: The HSTS header is sent in HTTP responses (browsers ignore it).

What fails:

HTTP response includes Strict-Transport-Security header

What passes:

HTTPS response includes Strict-Transport-Security header

How PixyScan detects this

PixyScan checks whether your web server sends the Strict-Transport-Security (HSTS) HTTP response header when accessed over HTTPS.

Detection process

PixyScan follows these logical steps to identify HSTS header issues:

  1. Verify HTTPS accessibility - PixyScan first checks if your site is accessible over HTTPS, since HSTS only works over secure connections.

  2. Check for HSTS header - PixyScan looks for the Strict-Transport-Security header in the HTTPS response.

  3. Validate header presence - If the HSTS header is present, PixyScan checks:

    • The max-age directive is set to at least 31536000 seconds (1 year)
    • The header is not duplicated (browsers ignore duplicated HSTS headers)
    • The header is only sent over HTTPS connections (not HTTP)

  4. Extract directive information - If the header is present, PixyScan identifies:

    • The max-age value (how long browsers should remember to use HTTPS)
    • Whether includeSubDomains is specified
    • Whether preload is specified

When the issue is flagged

The issue is flagged when any of these conditions are met:

  • The HSTS header is missing in HTTPS responses
  • The max-age value is less than 31536000 seconds (1 year)
  • The header is duplicated in the response
  • The header is sent over HTTP instead of HTTPS

When the issue passes

The issue passes when:

  • The HSTS header is present in HTTPS responses
  • The max-age directive is at least 31536000 seconds (1 year)
  • The header is not duplicated
  • The header is only sent over HTTPS connections

References