Does HSTS affect SEO?

Not directly — there is no HSTS ranking factor. HTTPS itself is a light ranking signal, and the indirect effects matter more: no mixed-content warnings, no redirect hop on every first visit, and no browser interstitials scaring visitors away.

How do I remove HSTS if I set it wrong?

Serve `max-age=0` and wait. Browsers that revisit will clear the entry, but any visitor who does not return before their stored max-age expires stays locked to HTTPS. You cannot force this remotely — which is the whole argument for ramping up slowly.

The checker says my headers aren't available. What does that mean?

We could only read the page through a rendered fetch, so no raw response headers were observed. Header checks are marked N/A rather than failed — they are excluded from the score instead of counting as zero.

Is HSTS enough on its own?

No. It only guarantees the transport. It does nothing about XSS, clickjacking, or MIME sniffing — those need CSP, frame protection and nosniff respectively. HSTS is the first header to add, not the last.

HSTS and security header checker

HSTS tells a browser to refuse plain HTTP for your domain from now on — it closes the window where a first request over an untrusted network can be intercepted before the redirect happens. Enter a domain and we'll read the live response headers and report HSTS along with the other headers that stop real attacks.

35%send no HSTS header

Across 959 websites analyzed

Measured across every site in our public database.

Why this matters

A redirect is not the same as HSTS

Redirecting HTTP to HTTPS still means the very first request left the device in plain text. On a hostile network that request can be intercepted and answered before your redirect ever arrives — the classic SSL-stripping attack. HSTS closes that gap by making the browser rewrite the request to HTTPS itself, before anything is sent.

It is also the header most dangerous to get wrong

HSTS is a promise with a duration. Once a browser has seen `max-age=31536000`, it will refuse plain HTTP for your domain for a year, and there is no way to reach out and undo that on visitors' machines. If your certificate lapses or a subdomain isn't ready for HTTPS, those users see a hard error with no click-through. This is why you ramp the max-age up rather than starting at a year.

How to fix it

1. Get HTTPS fully working first
Every subdomain you intend to cover must have a valid certificate and serve HTTPS correctly, and all internal links and assets should already be https. HSTS on top of a half-migrated site converts a warning into an outage.
2. Ramp the max-age
Start at `Strict-Transport-Security: max-age=300`, confirm nothing breaks, then move to 86400 (a day), then 2592000 (a month), then 31536000 (a year). Each step is reversible in practice only because the previous window was short.
3. Add includeSubDomains only when you mean it
`includeSubDomains` covers every subdomain — including ones that don't exist yet, and internal tools someone may later put on an http-only host. It is the right end state, but adding it early is the most common way teams lock themselves out of their own staging environments.
4. Treat preload as permanent
Submitting to the browser preload list bakes your domain into Chrome, Firefox, Safari and Edge builds. Removal takes months to propagate. Only do it once the full header (`max-age=31536000; includeSubDomains; preload`) has been running comfortably for a while.
5. Add the rest while you're in the config
`X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`, and a frame protection (`X-Frame-Options: SAMEORIGIN` or CSP `frame-ancestors`) are three lines that carry no compatibility risk. CSP is the genuinely hard one — start it in `Content-Security-Policy-Report-Only` mode and read the reports before enforcing.

Want this fixed rather than explained?

This one lives in server configuration, which we cannot reach on a hosted platform — so we do not claim to. What our fixed-price work includes is the exact spec your host or developer applies, written to be handed over as-is.

See fixed prices →

Frequently asked questions

Does HSTS affect SEO?: Not directly — there is no HSTS ranking factor. HTTPS itself is a light ranking signal, and the indirect effects matter more: no mixed-content warnings, no redirect hop on every first visit, and no browser interstitials scaring visitors away.
How do I remove HSTS if I set it wrong?: Serve `max-age=0` and wait. Browsers that revisit will clear the entry, but any visitor who does not return before their stored max-age expires stays locked to HTTPS. You cannot force this remotely — which is the whole argument for ramping up slowly.
The checker says my headers aren't available. What does that mean?: We could only read the page through a rendered fetch, so no raw response headers were observed. Header checks are marked N/A rather than failed — they are excluded from the score instead of counting as zero.
Is HSTS enough on its own?: No. It only guarantees the transport. It does nothing about XSS, clickjacking, or MIME sniffing — those need CSP, frame protection and nosniff respectively. HSTS is the first header to add, not the last.