HSTS header missing: what it is, why it matters, and how to fix it
This site does not send the Strict-Transport-Security (HSTS) HTTP header. HSTS tells browsers to only communicate with the server over HTTPS, preventing protocol downgrade attacks and SSL stripping.
Where this fits: security in SEO
Why hsts header missing hurts your rankings
Without HSTS, users who type your domain without https:// or follow an HTTP link will make an initial insecure request before being redirected to HTTPS. During this window, attackers can intercept the connection (SSL stripping attack). HSTS eliminates this vulnerability. While not a direct ranking factor, it is a security best practice that contributes to overall site trustworthiness and is required for HSTS preloading.
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site.
How to fix it
Add the Strict-Transport-Security header to your server's HTTPS responses. Start with a short max-age and increase it gradually. Once confident, add includeSubDomains and consider submitting to the HSTS preload list.
# Start with 1 hour for testing
Strict-Transport-Security: max-age=3600
# Production: 1 year with subdomains and preload
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadFrequently asked questions
What does "HSTS header missing" mean?
This site does not send the Strict-Transport-Security (HSTS) HTTP header. HSTS tells browsers to only communicate with the server over HTTPS, preventing protocol downgrade attacks and SSL stripping.
Why does hsts header missing matter for SEO?
Without HSTS, users who type your domain without https:// or follow an HTTP link will make an initial insecure request before being redirected to HTTPS. During this window, attackers can intercept the connection (SSL stripping attack). HSTS eliminates this vulnerability. While not a direct ranking factor, it is a security best practice that contributes to overall site trustworthiness and is required for HSTS preloading.
How do I fix hsts header missing?
Add the Strict-Transport-Security header to your server's HTTPS responses. Start with a short max-age and increase it gradually. Once confident, add includeSubDomains and consider submitting to the HSTS preload list.
How serious is this issue?
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects hsts header missing on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by hsts header missing, and hands you a ready-made fix task.
Check my site free