logo

Strict-Transport-Security Header on Plain HTTP Response

  • Risk:

  • Informational

  • Type:
  • Passive
Summary

A HTTP Strict Transport Security (HSTS) header was found, but HSTS headers are ignored on plain (non-HTTPS) responses.

HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL).

Solution

Review the configuration of this control. Ensure that your web server, application server, load balancer, etc. is configured to set Strict-Transport-Security for HTTPS responses.

References

https://datatracker.ietf.org/doc/html/rfc6797#section-8.1

Free security scan for your website