Checks / Links, canonical and speed

No HSTS header

Strict-Transport-Security makes browsers always use HTTPS, which prevents downgrade attacks.

hsts_missing · Links, canonical and speed · Notice

What triggers it

On a site that works over https, your home page's response has no Strict-Transport-Security header.

What to change

Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses.

Example

Response headers to add on your server or CDN:

Strict-Transport-Security: max-age=31536000; includeSubDomains

How to confirm the fix

1. Run curl -I https://example.com/ | grep -i strict-transport
2. Run a new crawl

How common it is

We have not measured how common this is on a sample of sites. Counts appear here when a study covers it.

About this check

Settings by platform

Where the setting lives on a few platforms, from each platform's own help page, read on 26 October 2026. On any other server, apply the fix box above.

Cloudflare

In Cloudflare: Edge Certificates → Enable HSTS → Max Age Header, Apply HSTS policy to subdomains. (Cloudflare help page)

Cloudflare warns: if you remove HTTPS before turning HSTS off, or before the Max Age Header has run out, your site is unreachable for visitors until one of those happens.

Netlify

Netlify: put this in _headers. (Netlify help page)

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Vercel

Vercel: put this in vercel.json. (Vercel help page)

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Strict-Transport-Security",
          "value": "max-age=31536000; includeSubDomains"
        }
      ]
    }
  ]
}

Related checks

• Invalid hreflang
• hreflang has no x-default
• Internal links point to redirects
• The home address changes language with the visitor's browser

How an audit works: method