HSTS header check

Verifies Strict-Transport-Security is present, has max-age ≥1 year, and includes subdomains — the single biggest SSL grade lift.

Quick answer

We fetch your response headers, look for Strict-Transport-Security, and score it on max-age, includeSubDomains, and preload.

What it checks

• Presence on HTTPS responses
• max-age ≥ 31536000 (1 year) for full points
• includeSubDomains directive
• preload directive (bonus)

Where to find it in Lemwatch

Site details → Security → Headers.

How to fix

1. Set Strict-Transport-Security: max-age=31536000; includeSubDomains; preload on your web server.
2. Verify every subdomain also serves HTTPS.
3. Submit to hstspreload.org once stable for 90 days.
4. Re-run the check.

FAQ

Is HSTS dangerous?

Only if you're not sure every subdomain has TLS — then includeSubDomains locks you out.

How much does it improve my grade?

Up to +15 points on the security score.

Related

• Security headers
• CSP header check
• Why did my SSL grade drop