HTTP Strict Transport Security (HSTS) header cannot be recognised

Sooraj V Nair
Published on
19 Jun 2018
1 min read

The most used web security policy mechanism is HTTP Strict Transport Security (HSTS). This header protects web applications against protocol downgrade attacks and cookie hijacking. This header also restricts the application from using only HTTPS communication. The header won’t allow communications via the insecure HTTP protocol. There are many web applications with the HTTP Strict Transport Security (HSTS) header cannot be recognised. These web applications are being served from not only HTTP but also HTTPS. It also lacks proper implementation of HSTS policy. HTTP Strict Transport Security is a web security policy mechanism to interact with complying user agents such as a web browser using only secure HTTP connections. This header informs the browser that, the site should not be loaded over HTTP. This header automatically converts all the requests to the site from HTTP to HTTPS.


        Strict-Transport-Security: max-age=31536000



The main impact under this vulnerability:-

  • As the communication is done via HTTP, the site will be vulnerable to man in the middle attack(MITM).

Mitigation / Precaution

Beagle recommends the following impacts:-

  • Try to set a proper HTTP Strict Transport Security
        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Sooraj V Nair
Sooraj V Nair
Cyber Security Engineer
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment
Experience the power of automated penetration testing & contextual reporting.