HSTS missing

Why it matters

Without the HSTS header, someone on the same open wifi can step in during that first step and send the visitor to a fake page. With HSTS the browser goes straight to https every time.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It reads the response headers of the homepage and checks whether Strict-Transport-Security is there.

Common causes

• The header was never switched on
• The host does not add it by default
• It was switched off after a problem with a subdomain

How to fix it

1. Make sure the whole site works on https first.
2. Add the header Strict-Transport-Security with max-age=31536000.
3. Only add includeSubDomains when every subdomain works on https.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Browsers do not remember that your site is secure". When everything is in order, the report says: "Browsers remember that the site is secure (HSTS)".