Skip to content
mistakes.show
793Kissues on 68,769 sites
  1. Home
  2. Mistakes
  3. No HSTS header
SecurityImportant

No HSTS header

Without Strict-Transport-Security, the first request can be downgraded to HTTP.

47%of Global websites

By market

  1. Global47%
  2. United Kingdom47%
  3. Netherlands46%
  4. Italy60%
  5. Spain50%
  6. Japan67%
  7. Latin America56%

How to fix

  1. 1Send Strict-Transport-Security: max-age=31536000; includeSubDomains.
  2. 2Once stable, consider the HSTS preload list.

Our crawler: 68,769 sites · Global · updated Oct 23, 2026 · Methodology

Found mistakes on your site?

We can fix them in one sprint. Reply within one business day.