HTTP Strict Transport Security tells supporting browsers to use HTTPS for a host after receiving its policy over a secure connection. SSLBoard inspects the returned HSTS evidence and identifies hosts where it does not observe an enabled policy.
Reading the policy
max-age controls how long a browser retains the policy. A zero value removes the stored policy rather than enabling protection. includeSubDomains extends the policy to subdomains, and preload signals an intention related to browser preload programs; that token alone does not prove the domain is on a browser’s list. MDN HSTS reference
The report can show policy details where available. A missing-HSTS finding describes the scan’s observation, not the state of every browser that has visited the site. A prior policy or a parent domain’s policy may affect a particular browser separately.
What a missing result means
If the endpoint is reachable and no enabled policy is observed, review where response headers are set. A CDN, reverse proxy, and application can produce different headers or overwrite one another.
When web evidence is incomplete, inspect connection and header details before concluding that the origin deliberately omits the policy. The scan is not a crawl of every URL and authenticated page in your application.
Roll out and verify
Confirm the affected site works over HTTPS before deploying a policy. Choose a duration and subdomain scope you can support. In particular, do not add subdomain coverage or seek preload until you understand the effect on all relevant services.
Retest the public endpoint after deployment and inspect the returned policy. Validate important application routes separately, then review HTTP redirects and other browser headers for related gaps.