How to fix "HSTS not enabled"

If your CyberVigil report lists HSTS as missing under security headers, your site works over HTTPS but doesn't tell browsers to stick with it. Turning it on takes about 20 minutes of setup, followed by a few weeks of raising the setting in stages.

HSTS is one of the few headers that can lock visitors out if you rush it, so this guide starts small on purpose. Check your site below to see what it sends today.

What does "HSTS not enabled" mean?

HSTS (HTTP Strict Transport Security) is a security header your website sends with its HTTPS pages. It tells the browser to use HTTPS for your domain from then on, even if someone types http:// or clicks an old link. The header looks like this:

Strict-Transport-Security: max-age=31536000

max-age is how long, in seconds, the browser should remember the rule. MDN notes that once a browser has the rule, it also won't let visitors click past certificate errors on your site.

Our scan reads the headers on your homepage. We count HSTS as in place when max-age is at least 15552000 seconds, about six months. If the header is missing, it shows as missing. If it's there with a shorter value, you'll see "max-age is shorter than 6 months," which is expected while you ramp up.

Why does HSTS matter?

Without HSTS, a visitor's first request to http://yourbusiness.com goes out unencrypted before your server redirects it. On public Wi-Fi, an attacker on the same network can intercept that redirect and keep the browser on plain HTTP. The hstspreload.org team lists this, along with cookie hijacking and browsing history leaks, as attacks HSTS helps prevent.

For most small business sites it's a modest improvement that builds on HTTPS you already have. The risk is in the setup. Once a browser stores the rule, your site has to keep working over HTTPS for the full max-age, or those visitors can't reach it at all.

What should I check before turning on HSTS?

Cloudflare and the preload list maintainers both say HTTPS has to be working before HSTS goes on. Run through this list first:

• Your site loads over HTTPS with a valid certificate on both yourbusiness.com and www.yourbusiness.com.
• Visiting http:// redirects to https://. Keep this redirect after HSTS is on.
• Your certificate renews automatically. With HSTS, an expired certificate becomes a hard block with no way to click through, so read what to do when a certificate is expiring if you're unsure.
• You know which subdomains you have, such as shop, mail or a client portal, and whether each one works over HTTPS.

How do I turn on HSTS safely?

Start with a short max-age and no extra flags, then raise it in stages. The preload list maintainers suggest stepping from five minutes to a week to a month, checking for broken pages at each stage and waiting the full max-age before moving on.

Stage 4 is where our scan marks HSTS as in place. Six months is the minimum we look for, and one year is a common choice. A fixed value keeps renewing itself, because each visit restarts the clock.

The fix steps in your CyberVigil report show max-age=31536000; includeSubDomains, which is a reasonable destination. If your domain has several subdomains, take the staged route above to get there.

Hold off on two extras until you're comfortable:

• includeSubDomains applies the rule to every subdomain. Add it only when all of them, including internal ones, work over HTTPS. Cloudflare warns that subdomains without HTTPS become inaccessible.
• preload asks browsers to build your domain into the browser itself. The hstspreload.org team says "HSTS preloading is not recommended," and that removal takes months to reach users.

Check the rest of your website setup

Run a free scan to see your certificate, HTTPS redirect, security headers and email settings in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I add the HSTS header on my platform?

Where you add HSTS depends on what sits in front of your site. If you use Cloudflare's proxy, set it there. Otherwise, add it at your host or web server.

How do I check that HSTS is working?

1. Re-run the security headers checker and look for Strict-Transport-Security with the max-age you set.
2. Check www.yourbusiness.com too. MDN says each subdomain should send the header itself, because a browser may visit www before it ever sees your main domain.
3. Click around after each stage, especially forms, checkout and any subdomains.

If the header doesn't show up, a cache or CDN in front of your site may still be serving an older copy. It's also possible the header was only added to the HTTP version of your site. Browsers ignore HSTS sent over plain HTTP, so it has to come with the HTTPS response.

What should you do next?

• Confirm HTTPS and automatic certificate renewal first, then add HSTS with a short max-age.
• Put a reminder in your calendar for each stage of the ramp-up so the setting doesn't stall at five minutes.
• Check your other headers with the free security headers checker.
• If any page still loads over HTTP, read why a website says "Not secure".