Glossary
HSTS
The header that tells browsers to never speak to your site over plain HTTP again.
What it means
HSTS stands for Strict-Transport-Security. It is a response header that tells a browser to use HTTPS for your domain for a stated period, even if a link, a bookmark or a typed address says otherwise. The browser upgrades the request before it leaves the machine.
A redirect from HTTP to HTTPS is good, but the first request still goes out in the clear. HSTS closes that window for every visit after the first.
A check reads the header from your published app and reports whether it is present and how long it lasts. It is one line in the place your app sets headers, and it is one of the few items on a result that is genuinely a ten minute job.
Findings that use this term
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026