Re-enable HSTS (max-age is zero)

Why it matters

A max-age of zero tells browsers to forget HSTS, so the site is sending the header but gaining no protection from it. It is often left over from a rollback.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find where max-age=0 is set (application, web server, CDN or proxy) and who put it there. If it was a deliberate rollback, make sure the reason is fixed first.
2. Check that the whole site works over HTTPS, http:// redirects to https:// and the certificate renews automatically.
3. Re-enable HSTS in stages. Start at max-age=300, then raise it to one day (86400), 30 days (2592000) and one year (31536000).
4. Check the header after each stage with the curl command below.

curl -sI https://example.com/ | grep -i strict-transport-security
# first stage
Strict-Transport-Security: max-age=300

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list