agentsiteaudit · Checks · Security

HSTS: make browsers always use the secure version of your site

HSTS (HTTP Strict Transport Security) is a header that tells browsers: "only ever visit this site over HTTPS". Once a browser has seen it, it will not load the insecure http:// version again, even if a link or a network tries to send it there.

Our check passes when HSTS is set with a max-age of at least 180 days (15552000 seconds), warns when it is shorter, and fails when it is missing on HTTPS.

In our November 2026 study of businesses selling to AI agents, 42% of the 1,190 websites we checked had no HSTS header, or one with a short max-age. See the full study.

Why it matters

Without HSTS, the first visit can still start on http://, where it can be intercepted on public Wi-Fi before the redirect to HTTPS happens. HSTS closes that gap for returning visitors.

What our check looks for

• Pass: HSTS with max-age 15552000+
• Warning: HSTS with shorter max-age
• Fail: Missing on https

Check ID security.hsts.present · Security · Medium priority

How to fix it

Apache or cPanel (.htaccess)

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS
</IfModule>

Only add this once your whole site works on HTTPS. Add includeSubDomains only when every subdomain also has HTTPS.

Nginx

add_header Strict-Transport-Security "max-age=31536000" always;

Put it in the HTTPS (port 443) server block only.

Cloudflare

SSL/TLS > Edge Certificates > HTTP Strict Transport Security

Turn it on with a max-age of at least 6 months. Read Cloudflare's warning about subdomains first.

Test it

curl -sI https://www.example.co.uk/ | grep -i strict-transport

You should see the header with the max-age you set.

Common mistakes

• Switching it on before every page and subdomain works on HTTPS, which locks visitors out of the parts that do not.
• Adding includeSubDomains when some subdomains, such as an old mail or staging address, have no certificate.
• Adding "preload" without understanding it. Preload lists are hard to get off again.
• A very short max-age, such as 300 seconds, which gives almost no protection.

Related checks

• Content Security Policy: a safety net against injected scripts
• CAA record: choose who can issue certificates for your domain

Written by Derek Moore, who builds and runs websites for small UK businesses. Last checked 30 October 2026.