Skip to content

Missing HSTS header: what it is and how to add it

Security · Fix this week · vibeliq reports this as “Browsers aren't told to always use HTTPS”

Why it matters

Without this setting (HSTS), someone on the same Wi-Fi can quietly downgrade a visitor to the insecure version of your site. One header closes that door.

How to check it yourself

Open DevTools, go to the Network tab, reload, click the first request and look under Response Headers for strict-transport-security. If it isn't there, it's missing.

What the fix involves

Send the header Strict-Transport-Security with a max-age of at least six months from your framework's or host's headers config. Make sure the whole site works on HTTPS first, because browsers will remember the instruction.

Reference: developer.mozilla.org

How vibeliq checks it

We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.

Related checks

All 38 checks