HSTS is too short

SeverityLow

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_hsts_weak

Short answer

Your home page sends a Strict-Transport-Security header, but its max-age is shorter than 180 days (15,552,000 seconds). When that time passes without a visit, the browser forgets the rule and the next visit starts with an interceptable plain-HTTP request again. Once every page works over HTTPS, raise it to one year: max-age=31536000. Like other security headers, HSTS does not affect rankings.

Why it matters

HSTS protects only as long as the browser remembers it. With a short max-age (a test value such as 300 left in place, or max-age=0, which switches HSTS off), occasional visitors are effectively unprotected: on public Wi-Fi, an attacker can intercept their first http:// request and strip the redirect to HTTPS. One year is the common recommendation and the minimum for the browsers' HSTS preload list.

How Glimana detects it

Glimana reads the Strict-Transport-Security header of your HTTPS home page, after following redirects. If the header is absent, this check is Not applicable; the separate No HSTS header check covers that case. If max-age is below 15,552,000 seconds (180 days), including 0 or a missing value, the check fails with low severity and shows the value it found; 180 days or more passes. includeSubDomains and preload are not required to pass.

How to fix it

Watch out

A long max-age cannot be withdrawn quickly: browsers that have seen it refuse plain HTTP until it runs out. Raise it only when every page and asset loads over HTTPS, and add includeSubDomains only if every subdomain, including mail, staging and internal hosts, has a valid certificate. Send the header once: if a plugin and the server both add it, browsers use only the first one, which may be the short value.

Find the finding in Glimana. Open Security; this check is in the Certificate and HTTPS group, with the evidence from the last scan under its title. The same problem is listed under Issues › HSTS is too short.
Apply the fix on your platform.

WordPressCloudflareApache / Nginx

First find where the current header comes from: a security or SSL plugin, or the server. Change the value there instead of adding a second header. On Apache, in .htaccess (needs mod_headers): Header always set Strict-Transport-Security "max-age=31536000". Purge your page cache afterwards.

SSL/TLS › Edge Certificates › HTTP Strict Transport Security (HSTS): enable HSTS, set Max Age Header to 12 months and save. If your origin also sends the header, use the same value there or remove it at the origin, so visitors do not receive two different headers.

Nginx, in the HTTPS server block: add_header Strict-Transport-Security "max-age=31536000" always;. A location block with its own add_header drops the inherited ones, so repeat the line there or use a shared include file. Apache, in the HTTPS virtual host: Header always set Strict-Transport-Security "max-age=31536000". Reload the server afterwards.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

Press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes when the check passes.