Opportunity Security
Missing HSTS header
- Severity
- Opportunity
- Impact
- Low
- Effort to fix
- Low
- Issue code
hsts_missing
Why it matters
Strict-Transport-Security forces browsers to always use HTTPS, preventing downgrade attacks.
How to fix it
Add a Strict-Transport-Security header, for example max-age=31536000; includeSubDomains.
How it affects your score
Finding this issue on any page costs the Security score 0.5 points, plus up to 4 more depending on the share of crawled pages affected. A smaller improvement with a modest effect on its own.
Find the affected URLs
Open Crawl > Issues and pick Missing HSTS header. Each affected URL is listed with its evidence, and Copy URLs or Export URLs hands the list to a developer. The issue also appears in the Action Plan, ranked by impact (low) and effort (low), and in the issues CSV under the code hsts_missing. After fixing, run a new audit and use Compare to confirm the URLs moved to fixed.