Missing HSTS (Strict-Transport-Security) Header

What this finding means

Your site does not send a Strict-Transport-Security header on its HTTPS responses. Browsers that have never visited before, or whose HSTS record for your domain has expired, have no instruction to skip plain HTTP — meaning every visit can begin as an insecure HTTP request before any redirect happens.

Why it matters

Without HSTS, every visit starts as a plain HTTP request that your server then redirects to HTTPS. That first request is a window: an attacker on the same network (a coffee-shop Wi-Fi, a compromised router) can intercept it and strip the redirect, keeping the victim on HTTP indefinitely — a classic SSL-stripping attack. HSTS closes that window by making the browser skip HTTP entirely on repeat visits, and the `preload` directive lets you close it on the very first visit too, by getting the domain baked into browsers' shipped preload lists.

What Nivaronix checks

Nivaronix's security headers checker inspects the response headers your site sends and reports whether Strict-Transport-Security is present. This is a security misconfiguration check based on the header's presence and configuration — not a vulnerability scan, exploit attempt, or penetration test.

Evidence example

Example only, for illustration — not evidence from a live scan of any specific site.

HTTP/1.1 200 OK
(no Strict-Transport-Security header present)

How to fix it

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

SSL/TLS → Edge Certificates → enable "Always Use HTTPS" and the HSTS toggle (sets the header at the edge; review the max-age, subdomains and preload options in that panel before enabling preload).

Verify the fix

Re-run a scan on your domain, or check manually with curl -sI https://your-domain.example, and confirm Strict-Transport-Security now appears in the response with the expected value.

Standards reference

RFC 6797 — HTTP Strict Transport Security (HSTS). See the methodology page for exactly how this finding is scored.