HSTS

Why it matters

HSTS tells browsers to always use HTTPS for your site, which prevents downgrade attacks and saves a redirect.

How to fix it

1. Once HTTPS works everywhere, send Strict-Transport-Security: max-age=31536000.

Check it with

• Security Headers Checker – Grade a site’s HTTP security headers (CSP, HSTS, X-Frame-Options and more).

Scoring: a passed check earns its full weight, a warning half and an error none. How the SEO score works

Test your page All checks