Skip to main content
All rules

SEC-004

Missing or weak Strict-Transport-Security header

MediumDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed

Strict-Transport-Security tells browsers to use HTTPS for your domain on every later visit, so nobody on the same network can downgrade a visitor to plain HTTP. Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses once every subdomain supports HTTPS.

In apps built with AI tools

Hosts redirect HTTP to HTTPS but do not always add HSTS for custom domains, and apps served from a custom server or container often miss it entirely.

What it checks

The Strict-Transport-Security header and its max-age on the HTTPS response.

Why it matters

Without HSTS a first visit can be downgraded to HTTP by an attacker on the same network.

Recommended fix

Send Strict-Transport-Security with a max-age of at least 180 days (15552000 seconds).

How to verify

Check the response headers of the homepage in DevTools → Network and confirm Strict-Transport-Security is present.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue SEC-004: Missing or weak Strict-Transport-Security header
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add the response header `Strict-Transport-Security: max-age=31536000; includeSubDomains` to every HTTPS response, using the framework or hosting headers config.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Check the response headers of the homepage in DevTools → Network and confirm Strict-Transport-Security is present.

Questions

Should I add preload?
Only when you are sure every subdomain will serve HTTPS for years; removal from browser preload lists is slow.

References