Security finding
A host does not force HTTPS, or its HSTS policy is missing or short
Security Warning Severity: Medium
Part of the audit HTTPS enforcement. Finding id: security.httpsEnforcement.
What it costs you
A visitor who types the address without https, or follows an old link, starts on an unencrypted connection. Someone on the same network can read that request and send the visitor elsewhere. HSTS tells the browser to skip HTTP next time; without it, or with a short max-age, every visit can start that way.
What to do
Redirect every HTTP request to HTTPS with a 301, and send Strict-Transport-Security with a max-age of one year on the HTTPS responses.
What it checks
- Insecure address does not redirect to HTTPS
- Browsers are not told to always use HTTPS
- HTTPS-only instruction expires too quickly
- HTTPS-only instruction skips subdomains
How to fix it
Redirect HTTP to HTTPS
Send the HSTS header
Extend HSTS to subdomains
- List every subdomain of [host] and check that each serves HTTPS with a valid certificate.
- Then add includeSubDomains to the Strict-Transport-Security header of [host].
- Do not add preload at the same time. It is a separate decision and removal from the preload list takes months.
How to check: curl -sI https://[host]/ | grep -i strict-transport-security
Thresholds
| Name | Default | Meaning |
|---|---|---|
min_hsts_max_age | 15768000 | Shortest acceptable HSTS max-age in seconds. Adjustable default of six months; not taken from a standard. |