HSTS max-age is below one year
In the reportStrict-Transport-Security max-age below one year
hsts_max_age_below_baseline · Review item
This appears when the Strict-Transport-Security header on your HTTPS pages sets a max-age below one year. Browsers then keep the rule for a shorter time, and the preload list does not accept it. Raise max-age step by step to at least 31536000.
Severity: Low. Review it when convenient: a shorter max-age is often a stage on the way up, not a mistake.
Why it matters
Scott Helme's HSTS cheat sheet recommends aiming for a max-age of one year after many small increases, and the HSTS preload list requires at least 31536000 seconds for a site to be submitted.
What to do
- Look at the finding: it shows the
max-agevalues seen on up to ten pages of this address, and every distinct value found on it. - If the current value has run without problems, raise it, for example from a month to a year.
- Send the same value from every page and every server of the address.
When to leave it as it is: if you are still raising max-age in stages and plan to reach a year, you can leave it until you do.
What we read
We read the first Strict-Transport-Security header on the final response of every crawled HTTPS page, with our own user agent, and group the pages by their address: bakery.example and www.bakery.example are judged separately.
An address is reported when a page's header can be read and its max-age is below 31536000 seconds, one year. A header that cannot be read, for example with a repeated directive, marks the page as not checked, and a second Strict-Transport-Security header is ignored.
Example & evidence
Illustrative example — one address, not a live audit.
https://bakery.example/ and its other pages send:
Strict-Transport-Security: max-age=2592000; includeSubDomains2592000 seconds is 30 days, below one year, so the address is reported with the pages that send it.
Strict-Transport-Security: max-age=31536000; includeSubDomainsA possible correction, once 30 days have run without trouble: one year.
Confirm & check again
Check for yourself: open a page over HTTPS with your browser's developer tools and read the max-age in Strict-Transport-Security.
Check again: Full audit — run a new full audit. Complete coverage with readable captured headers and no below-year policy can clear the prior finding. Removing the header may instead make this rule inapplicable; it does not prove a one-year policy, and the missing-header check may report the site.
Limits & sources
The check reads the value each page sends, not what a browser has stored or when that expires, and only the final response each page gave our crawler.
Confidence: High because the header value is read directly.
Sources
- Scott Helme, HSTS Cheat Sheet — recommends aiming for a max-age of one year after many small, incremental increases. Checked 28 September 2026.
- hstspreload.org, HSTS Preload List Submission — requires a max-age of at least 31536000 seconds, one year, for a site to be submitted to the preload list. Checked 28 September 2026.
Editorial review: 29 September 2026