HTTP Strict Transport Security tells a browser: for this host, use HTTPS, do not ask, do not offer the user a click-through. The browser remembers that for max-age seconds after receiving the policy over a secure connection.
That memory is the feature and the risk. SSLBoard inspects the returned HSTS evidence and flags hosts where it does not observe an enabled policy.
Reading the policy
| Directive | What it does | What to watch |
|---|---|---|
max-age | How long the browser keeps the policy | 0 removes a stored policy rather than enabling protection |
includeSubDomains | Extends the policy to every subdomain | Every subdomain, including ones you have not thought about, must work over HTTPS |
preload | Signals intent to browser preload programs | The token alone does not put you on anyone’s list |
The MDN HSTS reference has the full syntax.
A missing-HSTS finding describes what the scan observed, not the state of every browser that has ever visited you. A policy you served previously, or a parent domain’s policy, can still be in effect in a particular browser.
Why the header is missing when you know you set it
If the endpoint is reachable and no enabled policy is observed, the header is being set somewhere that is not the public edge.
Response headers pass through a chain: CDN, reverse proxy, application server. Each link can add, replace, or drop headers, and only what survives the last link reaches the browser. Find which component produces the response the internet sees, and set it there.
Roll it out in this order
The order matters because HSTS is difficult to reverse:
- Confirm the site genuinely works over HTTPS, on every route you care about.
- Ship a short
max-ageand watch. - Raise
max-ageonce you are confident. - Only then consider
includeSubDomains, and only after auditing every subdomain, including the internal-looking ones. - Treat preload as a separate decision with its own slow exit. Do not add it to get a green tick.
Then retest the public endpoint and read back the policy that was actually returned. Validate important application routes yourself, since the scan samples responses rather than crawling your app.
Related: HTTP redirects for the first request, and other browser headers for the rest.