Amhost Labs
Knowledge Base›HTTP Strict Transport Security missing

HTTP Strict Transport Security missing

Markdown-backed fix guides for Amhost Labs audit findings.

What is it?

HTTP Strict Transport Security, or HSTS, is an HTTP response header that tells browsers to use HTTPS for future visits to the site. This finding belongs to HTTPS and HTTP header hardening.

Why does it matter?

Without HSTS, a user who types the domain or follows an HTTP link can be exposed to downgrade attempts before the browser reaches HTTPS. HSTS helps browsers remember that the site should only be contacted securely.

How to fix it?

Add the header on HTTPS responses after confirming the site works correctly over HTTPS.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Start without preload unless you understand the operational commitment. Use includeSubDomains only after every subdomain that users may visit supports HTTPS.