HSTS and forcing HTTPS: Crawl Audit check 146

Short answer: HSTS (the Strict-Transport-Security header) tells browsers to use HTTPS for your site for a set time, even if someone types http://. That closes the gap a redirect alone leaves on the first request. Check 146 passes if the header is there and warns if it isn't.

What Crawl Audit checks

• Pass: a Strict-Transport-Security header is present. The report shows its value.
• Warning: no header.

It doesn't judge the value. Even max-age=0, which tells browsers to forget the rule, passes. Read the value in your report.

What the sources say

• MDN on max-age: "The time, in seconds, that the browser should remember that a host is only to be accessed using HTTPS."
• MDN on includeSubDomains: "If this directive is specified, the HSTS policy applies to all subdomains of the host's domain as well."
• With HSTS on, MDN notes the browser "will not allow the user to bypass secure connection errors, such as an invalid certificate."
• OWASP warns: "If the HSTS header is misconfigured or if there is a problem with the SSL/TLS certificate being used, legitimate users might be unable to access the website."

Rolling it out

• Start short, then lengthen. hstspreload.org suggests 300 seconds, then a week (604800), then a month (2592000), before going to a year or more.
• Add includeSubDomains only once every subdomain, including old ones like mail or staging, works on HTTPS.
• Preloading builds your domain into browsers. hstspreload.org itself says: "While HSTS is recommended, HSTS preloading is not recommended." Removal "takes months", so treat it as permanent.

Strict-Transport-Security: max-age=31536000; includeSubDomains

On devmarde.com

We send max-age=63072000 (two years), set by our host, without includeSubDomains or preload. It passes.

Sources

• MDN, Strict-Transport-Security (updated 11 September 2026).
• OWASP, HTTP Headers Cheat Sheet, and hstspreload.org, checked 6 October 2026.