Security & SSL

HSTS Not Enabled

HTTP Strict Transport Security (HSTS) is a security header that tells browsers to only communicate with your site over HTTPS. Without HSTS, users who type your domain without "https://" or follow HTTP links are vulnerable to SSL stripping attacks and man-in-the-middle interception during the initial HTTP-to-HTTPS redirect.

Symptoms

  • Security scanners flagging missing HSTS header
  • Users able to access the HTTP version of the site
  • SSL grading tools penalizing for missing HSTS
  • Vulnerability to SSL stripping attacks

Common Causes

  • HSTS header never configured on the web server
  • HSTS header only set on some pages but not all HTTPS responses
  • Too short max-age value (less than 1 year)
  • Missing includeSubDomains or preload directives

Step-by-Step Troubleshooting

  1. 1

    Check current headers

    Verify if the Strict-Transport-Security header is present.

    Use HTTP Headers →
  2. 2

    Check SSL certificate

    Ensure HTTPS is properly configured before enabling HSTS.

    Use SSL Certificate Check →
  3. 3

    Add HSTS header

    Add Strict-Transport-Security: max-age=31536000; includeSubDomains; preload to all HTTPS responses.

  4. 4

    Test clickjacking protection

    While configuring security headers, also add X-Frame-Options.

    Use HTTP Headers →
  5. 5

    Submit to HSTS preload list

    After confirming HSTS works, submit your domain to hstspreload.org for browser-level enforcement.

Recommended Diagnostic Tools

HTTP HeadersSSL Certificate CheckHTTP Headers

Monitor Security Headers

Track HSTS and other security header configuration.

Related Problems

Frequently Asked Questions