Validate your Strict-Transport-Security header against NCSC and Google Preload standards.
| Security Pillar | Status | Inspection Telemetry |
|---|
Strict-Transport-Security header, attackers on public Wi-Fi or compromised DNS networks can execute SSL stripping (converting HTTPS connections to insecure plaintext HTTP). Furthermore, missing HSTS fails UK Cyber Essentials Technical Control Domain 4 and disqualifies your domain from enterprise government procurement tenders.Select your deployment environment below and copy the tailored configuration snippet to enforce compliance immediately:
# /etc/nginx/conf.d/security.conf
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;HTTP Strict Transport Security (HSTS) is a web server directive that instructs browsers to strictly communicate over HTTPS only, preventing downgrade attacks, cookie hijacking, and man-in-the-middle exploits.
To be eligible for the Chrome HSTS Preload list, your header must have a max-age of at least 31536000 seconds (1 year), include the includeSubDomains directive, include the preload flag, and all subdomains must serve valid HTTPS certificates.
Transparent UK billing with isolated statement descriptors. Cancel anytime with 1 click.
Stop shipping exposed keys and missing headers in rapid AI builds.
The Retainer Justifier. Audit client sites, prove compliance, and automate remediation.
Statutory security armor for high-stakes regulated UK portals.
Authenticate to access your security workspace