Fix Guide

How to Add the HSTS Header

Tell browsers to reach your site over HTTPS only, closing the first-request gap.

Easy Medium Impact 15 min

HTTP Strict Transport Security tells browsers to use HTTPS for your domain for a stated period, so a first plain-HTTP request cannot be intercepted before the redirect happens. It is one response header. Add it only once HTTPS works everywhere, because a browser that has seen it will refuse HTTP until the max-age expires.

Why It Matters

Without HSTS, the very first request a visitor makes can be plain HTTP, and that is the request an attacker on the same network wants. Around 46% of audited sites do not send it.

How to Fix

Confirm HTTPS is complete

Every page, subdomain and asset must work over HTTPS first. HSTS makes this hard to undo.

Start with a short max-age

Begin at a few days while you verify nothing breaks, then raise it to a year (31536000).

Add includeSubDomains deliberately

It applies to every subdomain, including internal ones that may still be HTTP. Check before adding it.

Consider preload last

The preload directive plus submission to the browser preload list removes even the first request — and is genuinely difficult to reverse.

Code Fix

text

Before (broken)

curl -sI https://example.com | grep -i strict-transport
(no output)

After (fixed)

Strict-Transport-Security: max-age=31536000; includeSubDomains

Platform-Specific Instructions

WordPress

Set it in the server config or at the CDN, not in PHP, so it is present on static assets too.

Next.js

Add it in the headers() function, or at the proxy that terminates TLS.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs — and links each one straight to its guide.

Run a free audit

Free foreverNo signupResults in 30s