Hsts preload ineligible

security.headers.hsts_preload_ineligible

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, response headers

What the rule checks

Scope. Applies to HTTPS responses whose STS header carries the preload directive.

Expectation. Fails when an HTTPS response's STS header claims preload but max-age is below 31536000 seconds or includeSubDomains is missing. Exactly 31536000 with includeSubDomains passes; 31535999 fails. Directive names are case-insensitive and max-age may be quoted (`Max-Age="31536000"` is one year). Without preload, without an STS header, or over plain HTTP (header ignored) the check does not apply.

Source. hstspreload.org submission requirements (max-age >= 31536000, includeSubDomains, preload); RFC 6797 §6.1 (directive names case-insensitive, quoted-string values), §8.1

Detection: analyze_security; needs network.

Failing example

The check reports a violation here. Corpus case hsts_preload_ineligible. The case is a set of response headers; there is no page.

Response headersHTTP

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=3600; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Passing example

The check passes here and reports nothing. Corpus case hsts_preload_eligible. The case is a set of response headers; there is no page.

Response headersHTTP

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.