Trakis

Trakis · Rules

HSTS header missing

Whether the home page sends the Strict-Transport-Security header, with a max-age above zero. Without it, the first visit typed without https:// goes over plain http — the one request someone on the same network can intercept.

NoticeCRAWL-012 · Crawlability · checked once for the whole site

Where it usually comes from

The header is off by default on most servers and CDNs; it has to be switched on.

How to fix it

  • Send Strict-Transport-Security: max-age=31536000 from the server or the CDN (on Cloudflare: SSL/TLS, Edge Certificates, HSTS).
  • Add includeSubDomains only once every subdomain serves https.

How to check it yourself

Look at the response headers of the home page (developer tools, Network tab) for Strict-Transport-Security.

What it looks like in a report

Notice The site does not send Strict-Transport-Security, so a visit typed without https:// starts on plain http.

One header on the server or the CDN, set once for the whole site. (An example shop; the numbers are illustrative.)

How the audit counts it

CRAWL-012 is a notice in the crawlability category, and weighs lightly in that category’s score. It is a fact about the site as a whole, so it is reported once, not once per page.

If the finding is deliberate on your site, it can be accepted as intentional in the report. It then leaves the list and the score, and comes back on its own if what it shows changes.

Other crawlability checks

Find it on your site

A Trakis audit runs this check and the other 65 on your site, and tells you on how many pages each one sits. Or go back to all the rules.