What Is HSTS?

Learn how HTTP Strict Transport Security works, when to enable it, and what to check before using HSTS across subdomains.

Check HSTS configuration Read docs

Problem Summary

HTTP Strict Transport Security tells supporting browsers to use HTTPS for a site after seeing a valid HSTS header. It helps reduce downgrade risk, but it should be enabled only after HTTPS is ready for the intended hostnames.

Why It Matters

HSTS helps browsers avoid returning to HTTP after the first valid HTTPS visit.
includeSubDomains can affect every subdomain, including legacy and vendor-managed hosts.
Preload is a long-lived browser-list commitment and should be treated as an operational decision.

How Qourby Checks It

Checks HTTPS responses for the Strict-Transport-Security header.
Reports max-age, includeSubDomains, and preload directives when present.
Flags missing HSTS on sites that otherwise appear intended for HTTPS-only operation.
This check does not replace manual inventory of every subdomain before includeSubDomains or preload decisions.

Basic scanning checks externally observable configuration and response behavior. Manual penetration testing goes further with authenticated flows, exploit validation, source review, business logic testing, and human judgment.

Common Failures

Strict-Transport-Security missing from HTTPS responses.
max-age set too low for the team intent.
includeSubDomains enabled before all subdomains support HTTPS.
HSTS sent inconsistently across app routes or edge locations.
Preload directive added without a rollback plan.

How To Fix

Confirm HTTPS works for the canonical hostname and important aliases.
Start with a conservative max-age and increase after observing stable behavior.
Use includeSubDomains only after validating subdomain readiness.
Treat preload as a separate launch decision, not a default header option.
Set HSTS at the edge or reverse proxy when that layer reliably handles HTTPS.

Related Checks and Guides

Scanner check