Security headers

Tell browsers to keep using HTTPS

Why this matters

Strict-Transport-Security tells browsers to remember to use HTTPS. It is a response header: an instruction your server sends with a page.

What to do

1. Make sure HTTPS and the redirect from HTTP work correctly before adding this instruction.
2. Ask your host to set Strict-Transport-Security: max-age=31536000 on HTTPS responses. This tells browsers to remember HTTPS for one year.
3. What to tell your web developer: Please add Strict-Transport-Security: max-age=31536000 after confirming HTTPS works reliably. The checker expects at least six months, or max-age=15552000.

How to check the fix

Run the checker again and look for a pass for browsers being told to always use HTTPS. A developer can confirm the header is present on the HTTPS response.