FALKEN'S MAZE / CHECKS / HSTS
HSTS
What Joshua checks
Checks for a Strict-Transport-Security header.
Why it matters
HSTS forces browsers to use HTTPS and blocks downgrade attacks.
How to fix it
Send "Strict-Transport-Security: max-age=31536000; includeSubDomains".
In the Maze Score
- Worth
- 5 points (half for a warning)
- Severity
- Low
- Runs on
- Every scan, including the free report card
Related checks
- Certificate validityFree
- Certificate expiryFree
- Legacy TLS versionsFree
- HTTP redirects to HTTPSFree
- Mixed contentFree
- Cipher suitesPro (Watchtower)
How does your domain do? Scan it free and get a Maze Score in about a minute.