Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

HSTS for a year or more

HTTPS enforced by the browser (HSTS)

Will browsers refuse to load the site without HTTPS?

Why it matters

HSTS tells a browser to use HTTPS for the site from now on, which closes the gap a redirect leaves on the first plain request and blocks clicking through certificate warnings. One year is the minimum that browsers accept for their preload lists.

When a domain passes

Passes when the HTTPS response carries Strict-Transport-Security with a max-age of at least one year.

How to fix it

  1. Send Strict-Transport-Security with a max-age of 31536000 seconds or more on every HTTPS response.
  2. Add includeSubDomains once every subdomain works over HTTPS, then preload to join the browser lists.

An example record

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Reference specifications

All thirteen standards