HTTPS pages send no HSTS header

Why it matters

RFC 6797, the standard for the header, defines it as a way for sites to declare themselves accessible only over secure connections. Scott Helme's HSTS cheat sheet says no site is finished without it, and recommends aiming for a max-age of one year after many small, stepwise increases.

What to do

1. Look at the finding: it shows up to ten pages, both reads of each, and where your http:// addresses redirected.
2. Send Strict-Transport-Security: max-age=300 from your HTTPS responses, then raise it in steps towards a year once nothing breaks.
3. Add includeSubDomains only when every subdomain works over HTTPS.

What we read

We read every crawled HTTPS page with our own user agent, following redirects, and look for Strict-Transport-Security on every HTTPS step of the way. When a page answers 200 with complete HTML and no such header, we read it a second time straight away to confirm. We also request http:// for your domain and for its www. address.

The site's address is reported when every HTML page of that address lacks the header in both reads, and both http:// addresses redirect to an HTTPS page that answers 200. The header on any step of any one page, with any value, means no finding.

If either http:// address fails, or the site sits on a subdomain other than www., the check cannot conclude; if http:// does not redirect to HTTPS at all, another check reports that instead. The result needs a complete crawl: when the crawl stopped at its page limit, or a crawled page did not answer 200, the check cannot conclude.

Example & evidence

Illustrative example — one small site read twice, not a live audit.

http://bakery.example/ and http://www.bakery.example/ both redirect to https://bakery.example/, and every page answers both reads with:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8

No response has Strict-Transport-Security, so https://bakery.example is reported once, with its pages.

Strict-Transport-Security: max-age=31536000

A possible correction, once smaller values have run without trouble: send this header on every HTTPS response.

Confirm & check again

Check for yourself: open your home page over HTTPS with your browser's developer tools and look for Strict-Transport-Security in the response headers.

Check again: Full audit — run a new audit of the site. The finding closes when a complete crawl, with every page answering 200 over HTTPS and both http:// addresses redirecting to HTTPS, finds the header on your pages. A crawl cut short by its page limit, or a page that does not answer 200, cannot confirm it.

Limits & sources

The check sees whether the header is present, not its value; other checks read the value. It reads HTML pages only, a site that sends the header on some pages only is not reported, and it cannot judge a site on a subdomain other than www..

Confidence: High because each page is read twice and the header is read directly.

Sources

• IETF, HTTP Strict Transport Security (HSTS) — defines the header as a way for sites to declare themselves accessible only via secure connections, and tells browsers to ignore it on responses received over insecure transport. Checked 28 September 2026.
• Scott Helme, HSTS Cheat Sheet — says no site is finished without HSTS and recommends aiming for a max-age of one year after many small increases. Checked 28 September 2026.

Editorial review: 29 September 2026

Related

• HSTS max-age is below one year — the header is sent, but its max-age is under a year.
• The http:// version of your site does not redirect to https:// — the http:// address does not redirect to HTTPS at all.