Communication Security
HSTS Header Check (HTTP Strict Transport Security)
Learn what the HSTS header is, why it is essential to enforce HTTPS, and how to configure it to protect your visitors against downgrade attacks.
What this test checks
This test checks for the presence of the HTTP Strict-Transport-Security (HSTS) header. This header forces browsers to connect exclusively over HTTPS, even if the user enters an HTTP URL. It protects against downgrade attacks and connection hijacking.
Our recommendation
Add the HSTS header to your server configuration with a minimum duration of 31536000 seconds (1 year). Example for Apache: 'Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"' or for Nginx: 'add_header Strict-Transport-Security max-age=31536000; includeSubDomains;'. Test with online tools to verify configuration.
Security tests
Read more
CMS Security