The website doesn’t send the HSTS header, which tells browsers to always use HTTPS for it. Without it, a visitor’s first request can go over plain HTTP, where it could be intercepted, for example on public Wi-Fi.
What it means
HSTS (HTTP Strict Transport Security) is a response header such as Strict-Transport-Security: max-age=31536000. Once a browser has seen it, it uses HTTPS for the website for that many seconds, even when someone types or clicks an http:// address.
What triggers it
Once a week the Security headers check loads the home page over HTTPS. If it has no Strict-Transport-Security header with a max-age above zero, this Medium issue is raised. It shows in the app and isn’t emailed.
HSTS is also one of the six headers in the security headers grade. See Weak security headers.
Common causes
- The web server, hosting plan or CDN doesn’t send it by default.
- It was left off when the website moved to HTTPS and never added.
- It’s sent with max-age=0, which switches HSTS off.
How to fix it
- Make sure the whole website works over HTTPS and that plain HTTP redirects to it. See HTTPS not set up properly.
- Add Strict-Transport-Security: max-age=31536000 in your web server, CDN or hosting settings. In Cloudflare, for example, it’s under SSL/TLS → Edge Certificates.
- Only add includeSubDomains or preload once every subdomain works over HTTPS, because browsers will then refuse plain HTTP for them too, and preloading is hard to undo.
When it clears
The check runs weekly, so the issue disappears at the next weekly check that no longer finds the problem, and its action drops off the action plan 7 days later.
If you mark the action done and the problem is still found 14 days later, it comes back as “Fix didn’t work”. See Using the action plan.