Weak HSTS Scanner
Detects an HSTS header with a low max-age or missing includeSubDomains that leaves downgrade gaps.
What it checks
This scanner reviews your HSTS header and detects when it has a max-age that is too low or is missing the includeSubDomains attribute. That lets it identify HSTS setups that leave exploitable gaps.
Why it matters
HSTS forces browsers to always use HTTPS with your site, but if its duration is very short or it does not cover subdomains, there are windows where an attacker can force an unencrypted connection. That gap enables downgrade attacks that intercept traffic.
How to fix it
Set the HSTS header with a long max-age (typically one year, i.e. 31536000 seconds) and add includeSubDomains to cover the whole domain. This is usually done in your server or CDN configuration, and it is wise to test with a smaller value first if you are unsure.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free