EngineeringScoreSecurity Small
Enable HSTS
HSTS (HTTP Strict Transport Security) closes the gap that plain HTTPS leaves open: the very first request a browser makes to a domain, before it has ever seen the redirect to HTTPS, can still be intercepted and downgraded on an untrusted network. The header tells the browser to skip HTTP entirely for future visits, removing that window.
Why it matters
Without HSTS, a user's first visit or any link they click can be silently downgraded to plain HTTP by an attacker on the network, exposing them to session hijacking even though HTTPS is available.
How to fix
- 1 Add Strict-Transport-Security: max-age=31536000; includeSubDomains to all responses.
- 2 Verify HTTPS is enforced everywhere before enabling includeSubDomains.
- 3 Consider HSTS preload submission once the policy is stable.
Common mistakes
- Setting a very short max-age (or leaving it at the default) so the protection expires between visits and offers little real benefit.
- Adding includeSubDomains before every subdomain is confirmed to support HTTPS, which can break subdomains that are still HTTP-only.
- Assuming HSTS replaces the HTTP-to-HTTPS redirect: it only protects repeat visitors who have already loaded the header once.
How to verify
- 1 Inspect the response headers for Strict-Transport-Security and confirm max-age is at least a year (31536000 seconds).
- 2 Use a header-checking tool to confirm the value is present on every page, not just the homepage.
- 3 If subdomains are included, load each one directly over HTTPS to confirm none of them break.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.