Protect Against HTTP Attacks with HTTPS Strict Transport Policy | UpGuard

This advisory explains HTTPS Strict Transport Security (HSTS), outlines common HSTS-related risk findings identified by UpGuard (HSTS not enforced, missing includeSubDomains, and domain not on the HSTS preload list), and gives practical remediation steps and header examples (including max-age recommendations, includeSubDomains, and preload directives) plus testing and deployment guidance to ensure all domains and subdomains enforce HTTPS.