Security & SEO

    HSTS header check

    Verifies Strict-Transport-Security is present, has max-age ≥1 year, and includes subdomains — the single biggest SSL grade lift.

    Updated 2026-07-10
    1 min read
    hsts
    security-headers
    ssl

    Quick answer#

    We fetch your response headers, look for Strict-Transport-Security, and score it on max-age, includeSubDomains, and preload.

    What it checks#

  1. Presence on HTTPS responses
  2. max-age ≥ 31536000 (1 year) for full points
  3. includeSubDomains directive
  4. preload directive (bonus)

    5. Where to find it in Lemwatch#

    Site details → Security → Headers.

    How to fix#

  5. Set Strict-Transport-Security: max-age=31536000; includeSubDomains; preload on your web server.
  6. Verify every subdomain also serves HTTPS.
  7. Submit to hstspreload.org once stable for 90 days.
  8. Re-run the check.

    9. FAQ#

    Is HSTS dangerous?#

    Only if you're not sure every subdomain has TLS — then includeSubDomains locks you out.

    How much does it improve my grade?#

    Up to +15 points on the security score.

    Related#

  9. Security headers
  10. CSP header check
  11. Why did my SSL grade drop
    12. Was this article helpful?

    Previous

    Open port scan check

    Next

    Content-Security-Policy header check

    Related Articles

    Security Headers Explained

    What security headers are, why they matter, and how to fix them.

    Content-Security-Policy header check

    Parses your CSP and flags unsafe-inline, unsafe-eval, wildcard sources, and missing directives — the hardest security header to get right.

    Why did my SSL grade drop?

    SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it.

    How does Lemwatch track robots.txt changes?

    Lemwatch snapshots robots.txt on every check and alerts when disallow rules change, sitemaps disappear, or the file returns non-200.

    Back to Help Center