Web security

HSTS enabled with a long lifetime

Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.

Why it matters

Without HSTS, the first visit can be intercepted on public Wi-Fi and silently kept on unencrypted HTTP (SSL stripping), exposing logins and session cookies.

How to fix it

Quick fix · under 1 hour

Add the header in the web server (or CDN) configuration of the site.
Make sure every subdomain serves HTTPS before adding includeSubDomains.
Reload the web server and re-run the scan to confirm.

nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

All recommended headers (nginx)

# inside the server { } block that serves HTTPS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Test this now, free: Security headers checker - no sign-up.

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free