security fix workflow

How to fix a missing HSTS header

Add HTTP Strict Transport Security safely after HTTPS is working across all hosts.

What this issue means

HSTS tells browsers to use HTTPS automatically for future requests to the domain.

Why it matters

It reduces downgrade and man-in-the-middle risk when HTTPS is already deployed correctly.

Evidence to collect

Retest the final HTTPS URL and check whether browser-facing headers and assets are fixed together.

Start with the same URL in the linked CheckWebs tool, save the failing signal, apply the fix, then retest the final redirected URL. Avoid judging the fix from a cached screenshot or a different URL variant.

How to check it

1Run Security Headers Grade.
2Confirm HTTPS is valid on apex, www, and important subdomains.
3Check for mixed content before enabling long max-age.

How to fix it

1Start with a short max-age while testing.
2Increase max-age after all HTTPS routes are stable.
3Add includeSubDomains only when every subdomain supports HTTPS.

Platform-specific fixes

Next.js

Add Strict-Transport-Security in next.config headers or at the CDN.
Prefer CDN-level headers for consistent coverage.

Cloudflare

Enable HSTS from SSL/TLS edge settings after testing.
Be cautious with preload and includeSubDomains.

Nginx

Add the header in the HTTPS server block.
Reload and test headers on production.

Validate the fix

1Re-run Security Headers Grade.
2Confirm HTTP redirects to HTTPS before HSTS is relied on.

FAQ

Should every site use HSTS preload?+

Only after careful testing. Preload is hard to reverse and can break subdomains that are not HTTPS-ready.

Loading CheckWebs…

security fix workflow

How to fix a missing HSTS header

Add HTTP Strict Transport Security safely after HTTPS is working across all hosts.

What this issue means

HSTS tells browsers to use HTTPS automatically for future requests to the domain.

Why it matters

It reduces downgrade and man-in-the-middle risk when HTTPS is already deployed correctly.

Evidence to collect

Retest the final HTTPS URL and check whether browser-facing headers and assets are fixed together.

How to check it

1Run Security Headers Grade.
2Confirm HTTPS is valid on apex, www, and important subdomains.
3Check for mixed content before enabling long max-age.

How to fix it

1Start with a short max-age while testing.
2Increase max-age after all HTTPS routes are stable.
3Add includeSubDomains only when every subdomain supports HTTPS.

Platform-specific fixes

Next.js

Add Strict-Transport-Security in next.config headers or at the CDN.
Prefer CDN-level headers for consistent coverage.

Cloudflare

Enable HSTS from SSL/TLS edge settings after testing.
Be cautious with preload and includeSubDomains.

Nginx

Add the header in the HTTPS server block.
Reload and test headers on production.

Validate the fix

1Re-run Security Headers Grade.
2Confirm HTTP redirects to HTTPS before HSTS is relied on.

FAQ

Should every site use HSTS preload?+

Only after careful testing. Preload is hard to reverse and can break subdomains that are not HTTPS-ready.