Re-enable HSTS (max-age is zero) on Squarespace
Why it matters
A max-age of zero tells browsers to forget HSTS, so the site is sending the header but gaining no protection from it. It is often left over from a rollback.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- In your Squarespace site, open Settings then Domains (older sites: Settings then Advanced) and find the SSL options, or type SSL into the settings search.
- Choose HSTS Secure so that Squarespace sends a Strict-Transport-Security header with a real max-age, and save.
Related
- Reported by the HSTS check
- Add the Strict-Transport-Security (HSTS) header
- Fix the malformed Strict-Transport-Security header
- Raise the HSTS max-age
- Decide whether to add includeSubDomains
- Meet the HSTS preload requirements or remove preload
- Consider submitting the domain to the HSTS preload list
- Send HSTS on the redirect visitors meet first
Scan your domain to see whether this applies to you.