The site is not set up for HSTS preloading
What this check looks for
Browsers only learn to force HTTPS after the first visit. Preloading builds that instruction into the browser itself, so even the very first visit is secure.
Why it matters
Nothing is wrong here — preloading is optional and deliberately hard to undo. It is offered because it closes the one gap HSTS cannot: the very first request a browser ever makes to your site.
When the check passes, your report says: “The site is preloaded, so even a first visit is secure”.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- Web security
- Module
- Web security headers
- Fix owned by
- user
- In the ruleset since
- 2026.09
Technical detail
‹detail›
The preload list requires max-age of at least ‹required max age›, includeSubDomains, preload, and a redirect from HTTP to HTTPS on the same host. Removal takes months and browsers ship the list in their binaries, so treat submission as a decision rather than a setting.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other web security headers checks
- No Cross-Origin-Embedder-Policy is set
- No Cross-Origin-Opener-Policy is set
- No Cross-Origin-Resource-Policy is set
- No Content Security Policy is enforced
- The policy leaves plugins or the base URL unrestricted
- The Content Security Policy is report-only
- The policy allows eval()
- The policy allows inline scripts or styles
- The policy allows resources from anywhere
- A security header was sent twice with different values
- HSTS max-age is shorter than six months
- HTTP Strict Transport Security is not in force