SiteAud!tLint Support

Opportunity Security

Missing HSTS header

Severity
Opportunity
Impact
Low
Effort to fix
Low
Issue code
hsts_missing

Why it matters

Strict-Transport-Security forces browsers to always use HTTPS, preventing downgrade attacks.

How to fix it

Add a Strict-Transport-Security header, for example max-age=31536000; includeSubDomains.

What this means

The site's start page responds over HTTPS without a Strict-Transport-Security header. SiteAud!tLint checks this once per audit, on the start URL, because HSTS is a site-wide setting.

HSTS tells the browser: for the next period, only ever connect to this domain over HTTPS. After the first visit, a visitor who types example.com or follows an old http:// link goes straight to HTTPS without making an insecure request first.

Why it matters

HSTS has no direct ranking effect. It closes the gap that redirects leave open: without it, the first request on each visit can still go out over HTTP, where it can be intercepted or rewritten before your redirect answers. It also saves a redirect round trip on every repeat visit.

Example header

Strict-Transport-Security: max-age=31536000; includeSubDomains

max-age is in seconds; 31536000 is one year.

How to add it safely

  1. Confirm every page, and every subdomain you plan to cover, works over HTTPS. Browsers enforce HSTS strictly: a subdomain without a valid certificate becomes unreachable for visitors who have seen the header.
  2. Start with a short max-age, such as 300, and no includeSubDomains. Check nothing breaks.
  3. Raise max-age to a year and add includeSubDomains once all subdomains are on HTTPS.
  4. Add preload only if you intend to submit the domain to the browser preload list. Removal from that list takes months, so treat it as permanent.

Set the header where your site is served: the web server config, your host's headers settings (such as vercel.json or Netlify's _headers), or the CDN.

Verify the fix

Run curl -sI https://example.com and look for the header, then recrawl. The issue clears on the next audit. HSTS only protects pages that already work over HTTPS, so fix any pages served over HTTP and mixed content first.

How it affects your score

Finding this issue on any page costs the Security score 0.5 points, plus up to 4 more depending on the share of crawled pages affected. A smaller improvement with a modest effect on its own.

Find the affected URLs

Open Crawl > Issues and pick Missing HSTS header. Each affected URL is listed with its evidence, and Copy URLs or Export URLs hands the list to a developer. The issue also appears in the Action Plan, ranked by impact (low) and effort (low), and in the issues CSV under the code hsts_missing. After fixing, run a new audit and use Compare to confirm the URLs moved to fixed.