curious1
curious1

Reputation: 14717

Why my site is considered "No HSTS header is present on the response"

I am supporting a website

https://www.somesite.com

and I have followed all the requirements set at

https://hstspreload.appspot.com

However when I entered somesite.com to check status and eligibility, I got errors:

Error: No HSTS header
Response error: No HSTS header is present on the response.

Upvotes: 2

Views: 8328

Answers (1)

Barry Pollard
Barry Pollard

Reputation: 45895

The HSTS header is set on https://www.somesite.com/ but not on https://somesite.com/ which is a requirement:

Serve an HSTS header on the base domain for HTTPS requests

Btw as you don't yet have this on your base domain yet I would STRONGLY encourage you to run with it set there for a bit first before submitting for preload in case you have any http only other subdomains (e.g. http://blog.somesite.com or http://intranet.somesite.com) as they will stop working once preloaded as they will now also require https.

Upvotes: 2

Related Questions