Fix the malformed Strict-Transport-Security header

Why it matters

The header is present but does not follow the required syntax, so browsers ignore it and your site gets no HSTS protection. A small typo such as a missing max-age is enough.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. View the exact header the site sends with the curl command below and compare it with the correct form. It needs max-age=<seconds> and may add includeSubDomains and preload, separated by semicolons.
2. Common mistakes are a missing max-age, max-age with units such as 1y, a comma in place of a semicolon, a typo in a directive name, and the header being sent twice with different values.
3. Correct the value in the one place that sets it (application, web server, CDN or proxy). Look for a second place that adds the header and remove the duplicate.
4. Because a correct header turns HSTS on, treat this as adding it for the first time. Start with a short max-age of five minutes, then raise it to one day, 30 days and one year, as described in the fix for the missing header.

curl -sI https://example.com/ | grep -i strict-transport-security
# a valid header, first stage
Strict-Transport-Security: max-age=300

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list