How it works
With the Strict-Transport-Security header a site tells the browser to use HTTPS only for a set period, for example Strict-Transport-Security: max-age=31536000; includeSubDomains. From then on the browser rewrites every http:// URL for that domain to https:// internally, before a single request leaves the device (RFC 6797).
max-age is the duration in seconds; includeSubDomains extends the rule to every subdomain. The header only counts when it arrives over HTTPS with a valid certificate – sent over plain HTTP it is ignored.
Since the very first visit is still unprotected, there is a preload list: domains with a max-age of at least one year, includeSubDomains and preload can be submitted at hstspreload.org. All major browsers ship that list built in.
Why it matters
Without HSTS, every visit typed or linked as http:// starts unencrypted. On open Wi-Fi an attacker can intercept that first request and suppress the redirect to HTTPS (SSL stripping). Visitors stay on an unencrypted copy, and logins or session cookies travel in plain text.
Misconfigured HSTS locks people out: includeSubDomains on the main domain makes every subdomain without working HTTPS unreachable for browsers that have visited the domain once – including the old intranet at http://intranet.example.com. A preload entry takes months to roll back.
How to prevent it
- First make sure the domain, www and every subdomain in use answer over HTTPS with a valid certificate, and that http:// redirects to https:// with a 301.
- Start with a short lifetime (max-age=300) and raise it step by step to one or two years once everything works, for example max-age=63072000.
- Only add includeSubDomains after checking every subdomain, including those other vendors run for the client.
- Send the header on the first HTTPS response even if it redirects (say, from https://example.com to https://www.example.com) – otherwise the browser never learns the rule for the main domain.
- Only submit domains for preload when everything on them will stay on HTTPS for good.
How DomainWarn detects it
The Website check reads the headers of the HTTPS response: if Strict-Transport-Security is missing, ineffective (max-age missing or 0, or the header is malformed) or max-age is below 180 days, it adds a notice. These are deliberately notices without an incident, because a missing header is not an outage. The free HTTP headers tool rates missing or ineffective HSTS as a warning.
The Subdomain inventory checks the first HTTPS response of every known hostname for HSTS – only when the certificate is valid, since browsers ignore the header otherwise – and lists subdomains without HSTS as a notice, unless the domain itself sends HSTS with includeSubDomains. DomainWarn does not check whether a domain is on the preload list.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.