HSTS header is present

hsts_header

Checks for the Strict-Transport-Security header.

What does this rule check?

HSTS tells browsers to always use HTTPS for the domain, even if the user types http://. This prevents downgrade attacks and ensures all traffic is encrypted.

Why is this important?

Without HSTS, the first visit might be over HTTP before redirecting to HTTPS, creating a window for man-in-the-middle attacks.

How to fix

Add the Strict-Transport-Security header with a long max-age and includeSubDomains.

Examples

<!-- No HSTS header in response -->

Strict-Transport-Security: max-age=31536000; includeSubDomains

Agent fix snippet

Copy this snippet and paste it into your AI coding agent to fix this issue automatically.

Add HSTS header to your server configuration:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Start with a short max-age for testing, then increase to 1 year.