Your server does not send the Strict-Transport-Security (HSTS) header. Without it, browsers may connect over unencrypted HTTP before being redirected to HTTPS, leaving a window for man-in-the-middle attacks.
Add the `Strict-Transport-Security` header to your web server responses.
The Strict-Transport-Security header tells browsers to only connect to your site over HTTPS for a specified period. Without it, the first connection may be over HTTP, and an attacker could intercept or modify the redirect.
Without HSTS, users are vulnerable to SSL stripping attacks. HSTS also prevents users from clicking through certificate warnings, protecting against phishing with invalid certificates.
Add the Strict-Transport-Security header to your Nginx server block.
# In your Nginx server block (HTTPS only):
server {
listen 443 ssl;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}Add the header to your Apache virtual host.
<VirtualHost *:443>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</VirtualHost>
# Ensure mod_headers is enabled:
sudo a2enmod headersFor initial deployment, use a short max-age to test. Increase once verified.
add_header Strict-Transport-Security "max-age=300" always;add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;Confirm the HSTS header is present in responses.
curl -sI https://yourdomain.com | grep -i strict-transport-securityAfter making changes, use our free scanner to verify the fix is working correctly. DNS changes can take up to 48 hours to propagate, but most propagate within minutes.
The recommended max-age is 31536000 seconds (1 year). Start with 300 (5 minutes) for testing, then increase to 86400 (1 day), then to 31536000.
HSTS preloading adds your domain to a list built into browsers so even the very first connection uses HTTPS. Submit at hstspreload.org. This is very difficult to undo.
Yes, if all your subdomains support HTTPS. It is required for HSTS preloading and prevents attacks via insecure subdomains.