Website Does Not Implement HSTS Best Practices

How does this issue affect my security?

HTTP Strict Transport Security (HSTS) is an HTTP header that instructs clients, such as web browsers, to only access a website over encrypted HTTPS connections. Clients that respect this header will automatically upgrade all connection attempts from HTTP to HTTPS.

After a client receives the HSTS header upon its first website visit, future connections to that website are protected against Man-in-the-Middle attacks that attempt to downgrade the connection to unencrypted HTTP.

The browser will expire the HSTS header after the number of seconds configured in the max-age attribute.

How is this issue discovered?

You can determine whether or not an HSTS header is present by checking the domain against https://gf.dev/hsts-test. Alternatively, you can validate with the Google Chrome developer tools when examining the header "Strict-Transport-Security". 

You may want to perform additional preloading efforts against the domain, validating with https://hstspreload.org/. At this time, this issue type will raise measurements under the following scenarios:

How can I remediate this issue?

Add the appropriate directives for your HSTS header. Please review OWASP's Cheat Sheet for HTTP Strict Transport Security.

How can I resolve this issue?

Follow the resolution process, and select the applicable resolution:

• By selecting the finding and clicking on "Fixed" button
  • You have made the required changes to your asset and they are publicly available for validation.

• This is not my IP or domain
  • If this is the case, then please submit a Domain Removal request through the Digital Footprint section of the Scorecard. Please see: Manage Digital Footprint

• I cannot reproduce this issue and I think it’s incorrect
  • The asset is owned by your organization, but you have evidence that shows the measurement is incorrect.
• Compensating Control
  • If HSTS pre-load has been setup against the Apex Domain along with max-age directive set with 31536000 seconds (1 year) and includeSubDomains directive then we can accept the findings for removal. Please submit a resolution request by selecting the finding --> "Other resolutions" --> "I have a Compensating Control" --> Provide the details --> Submit. The HSTS Header for the Apex domain should look like below:

          Strict-Transport-Security:max-age=31536000; includeSubDomains; preload