http.hsts Reviewed July 2026

Quick fix

Verify HTTPS and certificate validation on every relevant route.

What this finding means

SecuTest validates the `Strict-Transport-Security` header on the HTTPS response and expects a positive numeric `max-age` of at least 15,552,000 seconds. `includeSubDomains` and preload are recorded but are not universally safe defaults.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, compromise, or business intent when those cannot be proven remotely.

Associated attack or threat scenario

Threat type SSL stripping and protocol downgrade

How the attack or failure scenario works

HSTS tells a browser to replace HTTP with HTTPS before sending the request. Without a cached or preloaded policy, an on-path attacker can intercept an initial HTTP visit and prevent the upgrade. HSTS reduces that opportunity but does not fix certificate or application vulnerabilities.

Conditions and limitations

  • The victim has no active HSTS policy cached for the hostname.
  • The victim begins with HTTP or follows an insecure link.
  • An attacker can modify traffic on the network path.

Why it matters

Security and business impact Missing, disabled, malformed, or short-lived HSTS leaves browsers able to make an insecure first or later HTTP request.

Step-by-step fix

Where to make the change

  • The outermost component emitting the public HTTP response: CDN, reverse proxy, ingress, web server, or application middleware.
  • Apply the control consistently to normal pages, redirects, error responses, and relevant subdomains.

Remediation procedure

  1. Verify HTTPS and certificate validation on every relevant route.
  2. Start with a modest positive `max-age` and monitor for breakage.
  3. Increase to at least 15,552,000 seconds when the deployment is stable.
  4. Add `includeSubDomains` and request preload only after every current and future subdomain is committed to HTTPS.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.

Nginx
add_header Strict-Transport-Security "max-age=15552000" always;

Apache
Header always set Strict-Transport-Security "max-age=15552000"

Cloudflare
Enable HSTS only after Full (strict) HTTPS is stable; add subdomains and preload deliberately.

Verify the fix

  1. Run `curl -I https://example.com/` and inspect `Strict-Transport-Security`.
  2. Confirm `max-age` is numeric and positive on normal and error responses.
  3. Test subdomains before adding `includeSubDomains`.
  4. Verify the public CDN response rather than only the origin.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Sending HSTS on HTTP responses, where browsers ignore it.
  • Adding `includeSubDomains` while a legacy subdomain still uses HTTP.
  • Setting `max-age=0`, which removes the stored policy.

Authoritative references