Missing HSTS

The first request. Typing `example.com` sends a plain HTTP request; a redirect answers it. The redirect is correct and it arrives after the request has already crossed the network.

An attacker on the path — a shared wireless network, a compromised router — can answer that request instead, serving a copy of the site over HTTP and relaying everything the visitor types.

HSTS means the browser upgrades the request internally on every subsequent visit: no plain request is ever sent, so there is nothing to intercept.

It also removes the click-through on certificate warnings, which is deliberate: a site that has committed to HTTPS should not offer visitors a way past a broken certificate.

What it does not do is protect the very first visit, before the header has ever been received. That is what preloading addresses.

`max-age=<seconds>` is how long the browser should remember. It is required, and it is the number that makes this hard to undo.

`includeSubDomains` extends the policy to every subdomain. Powerful and unforgiving: every subdomain, including ones created later, must then serve valid HTTPS or be unreachable.

`preload` signals intent to be included in the browser-maintained preload list, which ships inside browsers so even the first visit is protected.

A typical production value is `max-age=31536000; includeSubDomains` — one year, all subdomains — once HTTPS is verified everywhere.

`max-age=0` is how the policy is withdrawn, and it only reaches browsers that visit again while the previous policy is still live.

A browser that received `max-age=31536000` will use HTTPS for that domain for a year, regardless of what the site does afterwards.

If a subdomain covered by `includeSubDomains` cannot serve HTTPS, it is unreachable for those visitors — not degraded, unreachable — until the policy expires or they visit again and receive `max-age=0`.

Preloading is stronger again: the list is compiled into browsers, so removal requires a request to the list maintainers and then waiting for browser releases to propagate. That takes months.

This is why the deployment order matters more here than for any other header. Every other security header can be removed by deleting a line.

First, verify HTTPS works on every hostname you serve, including ones you had forgotten. A subdomain without a valid certificate is what turns this into an outage.

Start with a short lifetime: `max-age=300`. Five minutes limits the damage of any mistake to five minutes.

Raise it gradually — a day, a week, a month — checking each time that nothing broke.

Add `includeSubDomains` only after confirming every subdomain serves HTTPS, and only once the short `max-age` has proved the configuration.

Consider preloading last, and only if the domain will be HTTPS permanently. It is the least reversible step in a web configuration.

Throughout, keep the HTTP-to-HTTPS redirect in place. HSTS applies to browsers that have seen the header; the redirect serves everyone else.

`curl -I https://example.com | grep -i strict-transport-security` shows the header and its directives.

Read the value rather than its presence. `max-age=0` disables the policy while appearing configured, and a very short lifetime provides little protection.

Check subdomains individually if `includeSubDomains` is set, because that directive is a commitment on their behalf.

Note that the header is only honoured over HTTPS. Sending it on an HTTP response has no effect, which is occasionally how it appears configured and does nothing.

`transport.hsts` reports whether the header is sent on HTTPS responses, and `transport.hsts_directives` reports the parsed value — the lifetime, whether subdomains are included, whether preload is declared.

`transport.hsts_preload_list` reports whether the domain appears in the browser preload list, which is the difference between a policy that protects returning visitors and one that protects the first visit too.

`transport.http_redirect` covers the redirect that must remain in place regardless, and `transport.https` the underlying question of whether HTTPS works at all.

The report separates absent from present-and-weak, because a `max-age` of 300 and a `max-age` of 0 are different situations with the same header name.