hsts

Why my site is considered "No HSTS header is present on the response"


I am supporting a website

https://www.somesite.com

and I have followed all the requirements set at

https://hstspreload.appspot.com

However when I entered somesite.com to check status and eligibility, I got errors:

Error: No HSTS header
Response error: No HSTS header is present on the response.

Solution

  • The HSTS header is set on https://www.somesite.com/ but not on https://somesite.com/ which is a requirement:

    Serve an HSTS header on the base domain for HTTPS requests

    Btw as you don't yet have this on your base domain yet I would STRONGLY encourage you to run with it set there for a bit first before submitting for preload in case you have any http only other subdomains (e.g. http://blog.somesite.com or http://intranet.somesite.com) as they will stop working once preloaded as they will now also require https.