Skip to Content
HTTP Security HeadersIssue 62

No Strict-Transport-Security header

What Is This Issue

This issue checks whether your web server sends the Strict-Transport-Security (HSTS) HTTP response header when accessed over HTTPS.

What this issue checks

  • The HSTS header is present in HTTPS responses
  • The max-age directive is set to at least 31536000 seconds (1 year)
  • The header is not duplicated (browsers ignore duplicated HSTS headers)
  • The header is only sent over HTTPS connections (not HTTP)

What is considered a passing implementation

A passing implementation means:

  • The HSTS header is present in HTTPS responses
  • The max-age directive is at least 31536000 seconds (1 year)
  • The header is not duplicated
  • The header is only sent over HTTPS

Real-world example

A properly configured HSTS header looks like:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

This tells browsers to only connect to your site via HTTPS for the next year, including all subdomains, and indicates you want to be included in browser preload lists.

Why Is This Important

HSTS is critical for website security and indirectly affects SEO:

Crawlability

If your site is vulnerable to SSL stripping attacks, malicious actors could potentially manipulate your content or redirect crawlers to malicious pages, affecting your SEO.

Indexability

Similar to crawlability, security vulnerabilities can lead to indexing issues if crawlers are redirected to malicious or incorrect pages.

Rankings

While HSTS itself isn’t a direct ranking factor, sites with strong security headers signal quality to search engines. Security is part of Google’s page experience signals.

User Experience

HSTS protects users from man-in-the-middle attacks, particularly SSL stripping attacks where an attacker downgrades a connection from HTTPS to HTTP. Without HSTS, users clicking an http:// link can be silently redirected to an insecure connection.

AI Search / AEO

AI-powered search engines prioritize secure, trustworthy sites. HSTS demonstrates your commitment to security best practices.

SEO Health Score Impact

Resolving this issue improves your overall SEO health score by ensuring your site is protected against protocol downgrade attacks and that users always connect securely.

How XeoPix Detects This

XeoPix checks whether your web server sends the Strict-Transport-Security (HSTS) HTTP response header when accessed over HTTPS.

Detection process

XeoPix follows these logical steps to identify HSTS header issues:

  1. Verify HTTPS accessibility - XeoPix first checks if your site is accessible over HTTPS, since HSTS only works over secure connections.

  2. Check for HSTS header - XeoPix looks for the Strict-Transport-Security header in the HTTPS response.

  3. Validate header presence - If the HSTS header is present, XeoPix checks:

    • The max-age directive is set to at least 31536000 seconds (1 year)
    • The header is not duplicated (browsers ignore duplicated HSTS headers)
    • The header is only sent over HTTPS connections (not HTTP)

  4. Extract directive information - If the header is present, XeoPix identifies:

    • The max-age value (how long browsers should remember to use HTTPS)
    • Whether includeSubDomains is specified
    • Whether preload is specified

When the issue is flagged

The issue is flagged when any of these conditions are met:

  • The HSTS header is missing in HTTPS responses
  • The max-age value is less than 31536000 seconds (1 year)
  • The header is duplicated in the response
  • The header is sent over HTTP instead of HTTPS

When the issue passes

The issue passes when:

  • The HSTS header is present in HTTPS responses
  • The max-age directive is at least 31536000 seconds (1 year)
  • The header is not duplicated
  • The header is only sent over HTTPS connections

How To Fix

Follow these steps to implement HSTS properly:

Step 1: Ensure HTTPS is working correctly

Ensure HTTPS is working correctly on your site before enabling HSTS. Test that all pages load properly over HTTPS.

Step 2: Configure the HSTS header

Configure the HSTS header on your web server, CDN, or load balancer to send the header on all HTTPS responses:

Strict-Transport-Security: max-age=31536000

Step 3: Add includeSubDomains (optional)

Add includeSubDomains if all subdomains also support HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Step 4: Add preload directive (optional)

Add preload directive if you want to be included in browser HSTS preload lists (requires max-age of at least 31536000 and includeSubDomains):

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Step 5: Submit to HSTS preload list

Submit to HSTS preload list at hstspreload.org  if you included the preload directive.

Step 6: Verify configuration

Verify configuration using online tools like Security Headers  to ensure the header is properly set.

Step 7: Important - Only send over HTTPS

Only send the HSTS header over HTTPS connections, not HTTP. Browsers ignore HSTS headers sent over HTTP.

What We Store

Storage Level

Page Level — This issue is evaluated for each individual URL.

Database Table / Prisma Model

PageSecurityHeader

Stored Fields

FieldTypeDescription
hstsHeaderString?Strict-Transport-Security header value

Detection Dependencies

  • The following data sources are required to evaluate this issue:
  • HTTP Response Headers — The crawler checks for the presence and value of the Strict-Transport-Security header
  • HTTPS Connection — HSTS is only applicable to HTTPS responses

Examples

Example 1: Missing HSTS Header

Problem: The HSTS header is not present in HTTPS responses.

What fails:

HTTPS response does not include Strict-Transport-Security header

What passes:

Strict-Transport-Security: max-age=31536000

Example 2: Insufficient max-age Value

Problem: The max-age directive is set too low.

What fails:

Strict-Transport-Security: max-age=86400

What passes:

Strict-Transport-Security: max-age=31536000

Example 3: HSTS Header Sent Over HTTP

Problem: The HSTS header is sent in HTTP responses (browsers ignore it).

What fails:

HTTP response includes Strict-Transport-Security header

What passes:

HTTPS response includes Strict-Transport-Security header

Unit Test

Test File

__tests__/seo-audit-checks/httpSecurityHeaders/issue-136-strict-transport-security.test.js

Purpose

This unit test validates that the Strict-Transport-Security (HSTS) header check correctly identifies when the header is missing or empty in HTTPS responses.

Tested Function

runHttpSecurityHeaders() from toggleGroups/httpSecurityHeaders.js

Issue Information

  • Issue Number: 136
  • Issue Code: strict_transport_security
  • Toggle Group: httpSecurityHeaders

Test Scenarios

Positive Test Cases

Scenarios where the issue should be reported:

  • HSTS header is missing from the security headers object
  • HSTS header is present but its value is an empty string

Negative Test Cases

Scenarios where the issue should not be reported:

  • HSTS header is present with a valid value (e.g., max-age=31536000; includeSubDomains)

Boundary Cases

  • HSTS header with empty string '' — treated as missing and flagged

Edge Cases

  • Other security headers present (e.g., CSP) but HSTS missing — only HSTS is flagged

Expected Outcome

Pass

The issue is reported when the strict-transport-security header is absent or its value is an empty string.

Fail

The issue is not reported when the strict-transport-security header is present with a non-empty value.

Validation

The unit test verifies:

  • Correct detection of missing HSTS header
  • Correct detection of empty HSTS header
  • No detection when HSTS header is present and non-empty
  • The issue details message is populated correctly
  • toggleGroups/httpSecurityHeaders.js — contains the runHttpSecurityHeaders() function and extract() logic
  • issueCodes.js — defines IssueCode.STRICT_TRANSPORT_SECURITY

Coverage Summary

  • Covers the full HSTS header presence check
  • Tests missing, empty, and present header scenarios
  • Validates the issue detection message string

References

Last updated on
Issue 61Issue 63