How to fix: Subdomains don’t support HSTS

HSTS Semrush site audit tips

Issue: Subdomains without HTTP Strict Transport Security (HSTS) may serve unsecured content, potentially exposing your users to risks and harming trust and security.

Fix: Configure your server to support HSTS for your subdomains to ensure all content is served securely over HTTPS.

How to Fix for Beginners

  1. Check Server Support: Confirm that your hosting provider or server configuration supports HSTS.
  2. Enable HSTS for Subdomains: Add the HSTS header to your server configuration and include the includeSubDomains directive.
    • Example: Strict-Transport-Security: max-age=31536000; includeSubDomains
  3. Test Implementation: Use tools like SSL Labs to verify that HSTS is properly enabled across your subdomains.
  4. Update DNS Records (Optional): If your domain supports HSTS preload, ensure it is added to the preload list for maximum protection.
  5. Monitor for Issues: Check regularly to ensure all subdomains are being served securely with HSTS enabled.

Tip: Implementing HSTS improves security by ensuring all content is served over HTTPS, building user trust and protecting sensitive data.

Related Posts