---
title: "HSTS header check — Lemwatch Help"
description: "Verifies Strict-Transport-Security is present, has max-age ≥1 year, and includes subdomains — the single biggest SSL grade lift."
canonical: "https://lemwatch.com/help/hsts-header-check"
source: "https://lemwatch.com"
---

# HSTS header check

> Verifies Strict-Transport-Security is present, has max-age ≥1 year, and includes subdomains — the single biggest SSL grade lift.

## Quick answer

 We fetch your response headers, look for Strict-Transport-Security , and score it on max-age, includeSubDomains, and preload.

## What it checks

- Presence on HTTPS responses

- max-age ≥ 31536000 (1 year) for full points

- includeSubDomains directive

- preload directive (bonus)

## Where to find it in Lemwatch

 **Site details → Security → Headers.**

## How to fix

- Set Strict-Transport-Security: max-age=31536000; includeSubDomains; preload on your web server.

- Verify every subdomain also serves HTTPS.

- Submit to hstspreload.org once stable for 90 days.

- Re-run the check.

## FAQ

### Is HSTS dangerous?

 Only if you're not sure every subdomain has TLS — then includeSubDomains locks you out.

### How much does it improve my grade?

 Up to +15 points on the security score.

## Related

- Security headers

- CSP header check

- Why did my SSL grade drop


## Related

- [Help centre](https://lemwatch.com/help)
- [Security Headers Explained](https://lemwatch.com/help/security-headers)
- [Content-Security-Policy header check](https://lemwatch.com/help/csp-header-check)
- [Why did my SSL grade drop?](https://lemwatch.com/help/why-ssl-grade-dropped)
- [X-Frame-Options / frame-ancestors check](https://lemwatch.com/help/x-frame-options-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [HTML Validation Checks](https://lemwatch.com/help/html-validation)
- [Hreflang tag check](https://lemwatch.com/help/hreflang-tag-check)