HSTS
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that allows a server to declare via a response header that browsers may only access the domain over HTTPS. It effectively prevents SSL stripping attacks and protocol downgrade attacks.
Timeline (last 90 days)
HTTP response headers are a batch of key-value pair metadata that the server sends before returning the body, covering content type, caching policy, security policy (such as CSP, HSTS), cross-origin control (CORS), and X-prefixed custom fields; the browser parses some fields but completely ignores unrecognized custom fields, and never displays them to the user.
/api/ssl-pinning-policy-probe opens TLS connections on ports 443, 80 and 8443, capturing HSTS, Expect-CT, HPKP, X-Content-Type-Options, X-Frame-Options and port 80 downgrade redirect information
Measured: in the stripe.com SSL probe, HSTS max-age=63072000s, includeSubDomains, preload flag, hstspreload_list_member=true, score 60/C, rated weak, with points deducted for missing Expect-CT and no downgrade redirect
Measured: in the github.com SSL probe, HSTS max-age=31536000s, includeSubDomains, hstspreload_list_member=true, secure redirect on port 80, score 70/C
Industry mitigation measures include Certificate Transparency (CT), certificate revocation mechanisms (CRL/OCSP), HSTS, and Certificate Pinning.
All Facts (5)
HTTP response headers are a batch of key-value pair metadata that the server sends before returning the body, covering content type, caching policy, security policy (such as CSP, HSTS), cross-origin control (CORS), and X-prefixed custom fields; the browser parses some fields but completely ignores unrecognized custom fields, and never displays them to the user.
50%Unverified/api/ssl-pinning-policy-probe opens TLS connections on ports 443, 80 and 8443, capturing HSTS, Expect-CT, HPKP, X-Content-Type-Options, X-Frame-Options and port 80 downgrade redirect information
50%UnverifiedMeasured: in the stripe.com SSL probe, HSTS max-age=63072000s, includeSubDomains, preload flag, hstspreload_list_member=true, score 60/C, rated weak, with points deducted for missing Expect-CT and no downgrade redirect
50%UnverifiedMeasured: in the github.com SSL probe, HSTS max-age=31536000s, includeSubDomains, hstspreload_list_member=true, secure redirect on port 80, score 70/C
50%UnverifiedIndustry mitigation measures include Certificate Transparency (CT), certificate revocation mechanisms (CRL/OCSP), HSTS, and Certificate Pinning.
50%