Skip to content

HSTS (Strict-Transport-Security) Header

Tells browsers to only ever connect to your site over HTTPS, for a set period of time, without waiting for a redirect.

Last updated August 9, 2026.

Severity when missing: Medium — see the missing-header finding on the security headers checker.

Check if your site sends this header

What it does

HTTP Strict Transport Security (HSTS) is a response header that instructs a browser to remember, for a given max-age, that it should never load the site over plain HTTP. Once a browser has seen the header, it rewrites any future http:// request to https:// internally, before a single byte goes over the network.

Why it matters

Without HSTS, every visit starts as a plain HTTP request that your server then redirects to HTTPS. That first request is a window: an attacker on the same network (a coffee-shop Wi-Fi, a compromised router) can intercept it and strip the redirect, keeping the victim on HTTP indefinitely — a classic SSL-stripping attack. HSTS closes that window by making the browser skip HTTP entirely on repeat visits, and the `preload` directive lets you close it on the very first visit too, by getting the domain baked into browsers' shipped preload lists.

Example header

Example only — this is not evidence from a live scan.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

How to test for it

  • Load the site once over HTTPS, then inspect the response headers in your browser's network panel or with `curl -sI https://example.com` and look for a `Strict-Transport-Security` line.
  • Check `max-age` is a meaningful duration — 31536000 seconds (one year) is the common baseline for production sites.
  • If you intend to submit the domain to the HSTS preload list, confirm `includeSubDomains` and `preload` are both present and that every subdomain actually supports HTTPS before submitting.

How to add it

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Cloudflare

SSL/TLS → Edge Certificates → enable "Always Use HTTPS" and the HSTS toggle (sets the header at the edge; review the max-age, subdomains and preload options in that panel before enabling preload).

Verify the fix

After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.

Back to all security header guidesWebsite security scanner

Standards reference

RFC 6797 — HTTP Strict Transport Security (HSTS). For exactly how Nivaronix evaluates this header during a scan, see the methodology page.