Checks · HDR-001

HDR-001 · Missing HSTS

Why it matters

Without HSTS, a visitor's first request can be downgraded to plain HTTP on an unsafe network.

How we detect it

The HTTPS response has no Strict-Transport-Security header.

How we fix it

Send Strict-Transport-Security from the host or framework config.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-002 · Missing CSP
• HDR-003 · Clickjacking: no frame-ancestors or X-Frame-Options