HSTS (Strict-Transport-Security) tells browsers that already know your site to NEVER attempt a plain-HTTP connection again, even if a user types http:// or clicks an old http:// link — closing the specific window where a network attacker could intercept that very first request before a redirect to HTTPS happens.
HSTS forces browsers to only ever connect to your site over HTTPS, closing a window attackers use to downgrade connections. It is a modern security baseline Google's Best Practices audit checks.
HSTS (HTTP Strict Transport Security) closes a specific, real gap that HTTPS redirection alone leaves open — even with server-side redirects from HTTP to HTTPS configured, a visitor's very first request to your domain can still occur over plain HTTP before the redirect takes effect, creating a brief but genuinely exploitable window for a specific attack called SSL stripping.
The mechanism HSTS uses to close this gap is a browser-level instruction — once a browser receives the HSTS header from your site, it remembers to always connect via HTTPS for that domain going forward, for the duration specified, without ever attempting an initial HTTP connection that could be intercepted, effectively eliminating the vulnerable window redirect-only configurations leave open.
The HSTS preload list extends this protection even further, addressing the genuine edge case of a visitor's truly first-ever visit to your domain, before their browser has had any opportunity to receive and remember your HSTS header — preload list inclusion means major browsers enforce HTTPS-only connection to your domain by default, before any direct interaction with your server has occurred.
Implementing HSTS carries genuine, real technical stakes worth respecting — enabling this header commits your domain to consistently serving valid HTTPS, since browsers that have received this instruction will refuse to connect via HTTP at all, making this a configuration to implement only once your HTTPS setup is genuinely solid and reliable across your entire domain.
The Strict-Transport-Security header is present with a meaningful max-age, ideally including subdomains.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →