HSTS
What it can report
- ! medium (medium) How to fix it
- ! medium browsers ignore a malformed header) How to fix it
- ! medium max-age=0 clears HSTS). How to fix it
- ! low max-age under 15768000 s (6 months). How to fix it
- · info recommended, but it can break plain-HTTP subdomains, so it is a choice rather than a fault. How to fix it
- ! low the header asks for preload but the site misses an hstspreload.org requirement (valid certificate, http:// redirects to https:// on the same host, max-age ≥ 1 year, includeSubDomains, preload; registrable domain only). How to fix it
- · info HSTS is fine but not marked for preload. How to fix it
How it counts
The score is computed by fixed rules from the checks that ran, and this check has a weight of 3 within Security. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.
Related checks
Scan your own domain and see this check run.