Fix guide · tested 18 October 2026

How to fix "HSTS missing from HTTPS server"

Security scanners report "HSTS missing from HTTPS server" when your HTTPS responses don't include a Strict-Transport-Security header.

"HSTS missing from HTTPS server" means your site's HTTPS responses don't send the Strict-Transport-Security header, so browsers may still try plain HTTP first, where a network attacker can intercept the request. Fix it by sending Strict-Transport-Security: max-age=31536000; includeSubDomains on every HTTPS response, after confirming that every subdomain works over HTTPS. Start with a short max-age, raise it in stages, and only add preload when you're sure. Check it with one read-only request: curl -sI https://yoursite.com | grep -i strict-transport.

How we tested this: This site sends the header shown here from Cloudflare Workers static assets via a _headers file, and from its edge worker for redirects. We checked it with curl on 18 October 2026.

Why it matters

MDN describes HSTS as telling browsers that a host should only be reached over HTTPS, and that future HTTP attempts should be upgraded automatically. Without it, someone who types your domain or follows an old http:// link makes a first request over plain HTTP. On shared Wi-Fi, that request can be intercepted before your redirect to HTTPS arrives.

Two details matter. Browsers ignore the header if it's sent over plain HTTP, so it only works on HTTPS responses. And the very first visit is still unprotected until the browser has seen the header once, which is what the preload list addresses.

Check it first (read-only)

This sends one ordinary HEAD request and prints the header if it exists. It changes nothing.

curl -sI https://yoursite.com/ | grep -i strict-transport-security

No output means the header is missing. Free scanners such as Mozilla's HTTP Observatory and Security Headers report the same thing (see free website security scanners).

The fix, step by step

Make sure everything works over HTTPS. Check your main domain and every subdomain, including ones only used internally. With includeSubDomains, browsers will refuse plain HTTP on all of them.
Add the header with a short max-age. The HSTS preload site recommends ramping up in stages: 5 minutes (300), then 1 week (604800), then 1 month (2592000), checking for broken pages at each stage. On Cloudflare Workers static assets or Cloudflare Pages, put it in a _headers file in your output folder.
```
/*
  Strict-Transport-Security: max-age=300; includeSubDomains
```
Raise max-age to one year. When nothing breaks, set the long value. This is what this site sends today.
```
Strict-Transport-Security: max-age=31536000; includeSubDomains
```
Cover redirects too. If your redirects (for example www to the bare domain) come from a worker or server, send the header on those HTTPS responses as well. This site's edge worker adds it to its 301 responses.
Verify. Run the curl check again on a few pages and on a redirect. Each HTTPS response should include the header.

Should you add preload?

MDN notes that preload requires a max-age of at least 31536000 (one year) and includeSubDomains. Being on the preload list protects even first visits, because browsers ship with your domain built in. It's also hard to undo: removal takes a long time to reach every browser. Only submit at hstspreload.org once you're sure every subdomain will stay on HTTPS.

Other hosts

The header is the same everywhere. Only where you set it changes: your host's headers configuration (for example a headers file or project config on static hosts), your web server's config, or your CDN's response header rules. Set it on HTTPS responses only, then run the curl check. If your site is behind a CDN, set it in one place to avoid sending two different values.

Common mistakes

Starting with a one-year max-age and includeSubDomains while an internal subdomain still uses HTTP. Browsers will refuse to load it for a year.
Sending the header only on the homepage. Apply it to every path.
Expecting it to fix a missing redirect. You still need HTTP to HTTPS redirects for first-time visitors.

FAQ

What does "HSTS missing from HTTPS server" mean?

Your HTTPS responses don't include the Strict-Transport-Security header, so browsers aren't told to always use HTTPS for your site.

What HSTS value should I use?

max-age=31536000; includeSubDomains is a common long-term value. Start lower, for example max-age=300, and raise it in stages once you've confirmed every subdomain works over HTTPS.

Can HSTS break my site?

Yes, if a subdomain doesn't support HTTPS and you use includeSubDomains. Browsers will refuse to load it until max-age expires. Ramp up gradually.

Does HSTS work over HTTP?

No. Browsers ignore the header when it's sent over plain HTTP. It must be on HTTPS responses.

How do I check HSTS without changing anything?

Run curl -sI https://yoursite.com/ | grep -i strict-transport-security, or use a free header scanner such as Mozilla's HTTP Observatory.

Want someone to check it for you?

We check this as part of the $49 AI Site Audit. See how we test and what we don't check.

How this guide was made: researched and drafted with AI assistance, then every step was run and checked as described above on 18 October 2026. Editorial responsibility: ChikuOS. Found a problem? Email hello@chikuos.com.