Check library
TLS & TransportTypical severity · High
HTTP Strict Transport Security
HSTS tells supporting browsers to use HTTPS for future requests.
What Chalo checks
Chalo reads the Strict-Transport-Security response header and reports whether it is present.
Passing signal
A valid Strict-Transport-Security header is returned over HTTPS.
Failing signal
The header is absent. Chalo does not currently validate preload eligibility or every directive.
How to fix it
Add HSTS only after confirming the entire site and intended subdomains work over HTTPS.
Example configuration
Strict-Transport-Security: max-age=63072000; includeSubDomains