en
/login
Koval SEO

HSTS asks for preloading but fails a checked requirement

In the reportHSTS preload declared but preload requirements unmet

hsts_preload_preconditions_unmet · Review item

Short answer

This appears when your Strict-Transport-Security header asks for preloading and one of the requirements we check is not met: a max-age of a year, includeSubDomains, and a first redirect from http:// to HTTPS on the same host, answered with the header. The preload list accepts only sites that meet all of its requirements. Meet them, or remove preload if you do not mean to join it.

Severity: Low. Review the inconsistent preload declaration. A failed HTTP-to-HTTPS redirect can still leave plain-HTTP access, and the preload site does not generally recommend joining the list.

Why it matters

The HSTS preload list site sets the requirements for submission, including a max-age of at least 31536000 seconds and the includeSubDomains and preload directives. It warns that inclusion cannot easily be undone, and says that while HSTS is recommended, preloading is not.

What to do

  1. Look at the finding: it shows which of the four checks failed and how http:// for the host redirected.
  2. If you mean to preload, fix what failed: raise max-age, add includeSubDomains, or make http:// redirect first to HTTPS on the same host, with the header on that HTTPS answer.
  3. If you do not, remove preload from the header.

When to leave it as it is: if you added preload on purpose and are still working through the requirements, you can leave it until they are met.

What we read

We read the first Strict-Transport-Security header on the final response of every crawled HTTPS page, with our own user agent, and the redirects we followed from http:// for your domain and its www. address.

An address is reported when a page's header contains preload and one of four checks fails: a max-age of at least 31536000, includeSubDomains present, the first answer to http:// for the host being a redirect to HTTPS on the same host, and that HTTPS answer sending the header, whatever its value. For a host other than your domain or its www. address, the redirect is not read, so the last two checks cannot be made.

Example & evidence

Illustrative example — one header, not a live audit.

https://bakery.example/ sends:

Strict-Transport-Security: max-age=31536000; preload

The header asks for preloading but has no includeSubDomains, so the address is reported with that check failed.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

A possible correction, once every subdomain works over HTTPS: add includeSubDomains. If you do not want to join the list, remove preload instead.

Confirm & check again

Check for yourself: enter your domain on hstspreload.org: it lists every requirement it finds unmet, including ones this check does not read.

Check again: Full audit — run a new full audit. Complete coverage with no failed or unknown checked preload condition can clear the prior finding. Removing preload can make this rule inapplicable and close the prior finding, but does not prove that the site meets preload requirements.

Limits & sources

Only four requirements are checked. The certificate, HTTPS on every subdomain, whether the host is your base domain and whether the site is on the list are not, so a clean result is not a verdict on eligibility.

Confidence: High because the header and the redirect are read directly.

Sources

  • hstspreload.org, HSTS Preload List Submission — lists the submission requirements, including a max-age of at least 31536000 seconds and the includeSubDomains and preload directives, and says that while HSTS is recommended, preloading is not. Checked 28 September 2026.

Editorial review: 29 September 2026