Checks · security

Missing HSTS Header

Opportunity security.missing_hsts

What it means

The HTTPS site does not send a Strict-Transport-Security header, so a first visit over HTTP can be intercepted before the redirect happens.

How to fix it

Send Strict-Transport-Security with a max-age of at least a year, once you are certain every subdomain can serve HTTPS.

Where to find it in Truelint

Open the Issues pane on the right of the workspace and select Missing HSTS Header. The grid filters to every affected URL and the detail pane shows the specific finding for each. Export the list with Export → Current view, or from the API:

GET /api/v1/crawls/{handle}/issues/security.missing_hsts