Readiness check · Harden lane · weight 7
HSTS kept for at least a year
The homepage sends Strict-Transport-Security with max-age of at least 31536000 seconds (one year).
- Observed on
- 34%
- Top 1K sites
- 48%
- Top 1M band
- 26%
- Not measured
- 11,311
of 28,784 measured sites
286 measured
4,672 measured
blocked, challenged or not applicable
Why it matters
HSTS tells browsers to use HTTPS for your host on every later visit, which removes the window where a first HTTP request can be intercepted.
How to fix it
Send Strict-Transport-Security on HTTPS responses. Start with a short max-age (for example 300 seconds), confirm every subdomain works over HTTPS, then raise it in steps to 31536000. Add includeSubDomains only when all subdomains are HTTPS. HSTS preload is optional and hard to undo; hstspreload.org itself does not recommend it by default.
How we check
The homepage sends Strict-Transport-Security with max-age of at least 31536000 seconds (one year).
Observed: HSTS present with max-age of one year or more.
Not observed: HSTS missing or set below one year.
Limit: Read from the homepage response only; other pages or regions may send different headers.
Stack-specific steps
- Cloudflare: Enable HSTS under SSL/TLS > Edge Certificates > HTTP Strict Transport Security and raise max-age gradually.
- Amazon CloudFront: Attach a response headers policy with Strict-Transport-Security to each distribution.
- Next.js: Add the header in the headers() option of next.config.js for all routes.
- Fastly: Add the header in VCL or a header rule as described in Fastly's HSTS guide.
- Azure Front Door/CDN: Add a response header action in a Front Door rule set.
- Vercel: Declare the header in the headers section of vercel.json.
By popularity band
| Chrome UX Report band | Observed | Measured |
|---|---|---|
| Top 1K | 48% | 286 |
| Top 5K | 39% | 1,308 |
| Top 10K | 40% | 1,648 |
| Top 50K | 35% | 12,853 |
| Top 100K | 36% | 3,896 |
| Top 500K | 34% | 4,121 |
| Top 1M | 26% | 4,672 |
Categories most likely to do this
Categories least likely
By stack
- Next.js on Vercel97%
- Adobe Experience Manager on Amazon CloudFront84%
- Adobe Experience Manager79%
- Next.js on Fastly72%
- Webflow65%
- Magento / Adobe Commerce60%
- Sitecore59%
- Nuxt on Amazon CloudFront51%
- Next.js51%
- Next.js on Amazon CloudFront50%
- Angular50%
- Astro49%
- WordPress on Amazon CloudFront44%
- Next.js on Akamai43%
- Drupal42%
- Next.js on Cloudflare42%
- Next.js on Google edge41%
- Nuxt35%
- Drupal on Cloudflare32%
- WordPress26%
- Nuxt on Cloudflare25%
- WordPress on Cloudflare24%
- PrestaShop24%
- Blogger8.5%
- Shopify5.7%
By provider
- Vercel96%
- Azure Front Door/CDN63%
- Imperva61%
- Fastly56%
- Amazon CloudFront47%
- Akamai45%
- Google edge38%
- Cloudflare24%
Popular sites where we observed this
Sources and guides
- MDN: Strict-Transport-Security
- HSTS preload list requirements and cautions
- Cloudflare: HSTS
- Amazon CloudFront: response headers policies
- Fastly: enabling HSTS
Guide: HTTPS and TLS Guide for Website OwnersCheck your own site