FmindSecurity guide
Always use HTTPS (HSTS)
Without HSTS, your visitors’ browsers may first try the unencrypted version of your site, which can be intercepted on shared networks such as public Wi-Fi.
Who can help
Your web host or web developer
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- In your browser’s developer tools (Network tab), open the HTTPS homepage response and note the exact Strict-Transport-Security value and who manages it. Keep any existing stronger policy, including one set on the parent domain or through the browser preload list.
URL: https://YOUR_HOSTNAME/
Response header: Strict-Transport-Security
Existing value and policy owner: RECORDWhat to do
Only enable HSTS once HTTPS works reliably across your whole site: browsers remember it, even after you remove it. Ask your host for the Strict-Transport-Security header with a short duration first (max-age=300, five minutes), then increase it step by step to at least 180 days (max-age=15552000), ideally one year (max-age=31536000). Only add includeSubDomains or preload once every subdomain works over HTTPS: they are hard to undo.
How to verify the change
Run this check again: this item should show Good. Then check that your main pages still load normally.
What this check can establish
We check that the setting is present and lasts at least 180 days. We don’t judge whether its options (includeSubDomains, preload) suit your site.