HSTS max-age is short

Check id: hdr.hsts_short · fix effort: low

What it means

Your always-encrypt instruction expires quickly, which weakens it for occasional visitors. Bump it to a year.

The technical detail

HSTS max-age is under 180 days. One year is the baseline and preload lists require it.

How to fix it

  1. Raise max-age to 31536000 (1 year).

Does your domain have this problem?

Run a free scan, takes about ten seconds.