Checks / Links, canonical and speed
No HSTS header
Strict-Transport-Security makes browsers always use HTTPS, which prevents downgrade attacks.
hsts_missing · Links, canonical and speed · Notice
What to change
Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses.
Example
Response headers to add on your server or CDN:
Strict-Transport-Security: max-age=31536000; includeSubDomainsHow common it is
We have not measured how common this is on a sample of sites. Counts appear here when a study covers it.
About this check
| Check ID | hsts_missing |
|---|---|
| Report section | Links, canonical and speed |
| Severity | Notice |
| How it is decided | Measured: read directly from the page or the server's response. |
| Added | Before 19 Oct 2026 (versions 1 and 2), or a site-wide check with no version date yet |
| Status | Measured in every report |
| Report gives the code | Yes, one block for the site |
Related checks
- Broken internal links
- Canonical points to a broken or redirecting URL
- Redirect loop
- Canonical points to a noindex page
- Canonical points to another page
- Pages refuse or do not answer our crawler
See whether it applies to your site
Paste your address and we crawl up to 10 pages and show every issue we find, with its fix. No account, no card.
Every plan crawls up to its page limit and lists these checks with the fix: plans.
How an audit works: method