Hsts max age too short

Quick win

Increase your HSTS max-age directive to at least 31536000 seconds (1 year) so browsers enforce HTTPS connections for a meaningful period.

What it is

HTTP Strict Transport Security (HSTS) is a security header your web server sends to browsers that says: "Only ever connect to this site over HTTPS — never plain HTTP." The `max-age` value inside that header tells the browser how many seconds to remember and enforce that rule. A value of 86400 means just one day — after 24 hours the browser forgets the instruction and could allow an unencrypted HTTP connection again. The industry standard is 31536000 (one full year), meaning the browser stays protected for 365 days after each visit.

Why it matters

A short max-age creates a real window of vulnerability every single day. If a visitor's browser cache expires and they visit your store over an insecure network (coffee shop Wi-Fi, hotel hotspot), an attacker can intercept that initial unencrypted HTTP request and steal login credentials, session cookies, or payment data — a classic SSL-stripping attack. Beyond security, Google has used HTTPS as a ranking signal since 2014 and continues to favor sites that implement it properly; a misconfigured HSTS header signals to security-aware crawlers and auditors that your HTTPS setup is incomplete. Short max-age values are also explicitly flagged by OWASP and browser preload-list requirements, and many enterprise buyers and compliance frameworks (PCI-DSS, SOC 2) require HSTS to be set correctly before approving a vendor.

How to fix it

  1. Locate where your site sets HTTP response headers — this is typically your web server config (Nginx, Apache), a CDN/proxy layer (Cloudflare, Fastly), or a platform-specific security-headers setting.
  2. Find the existing Strict-Transport-Security header (it may already be set by a plugin, app, or server rule with the short max-age value).
  3. Change the max-age value to 31536000. The minimal correct header is: Strict-Transport-Security: max-age=31536000. For maximum protection also add includeSubDomains if all your subdomains serve HTTPS, e.g.: Strict-Transport-Security: max-age=31536000; includeSubDomains.
  4. Optionally add the preload directive (Strict-Transport-Security: max-age=31536000; includeSubDomains; preload) only if you are prepared to submit your domain to the HSTS preload list — this bakes your domain into browsers themselves, but is a one-way commitment that can take months to reverse.
  5. Deploy the change, then verify by loading your site and inspecting the response headers in browser DevTools (Network tab → select any request → Headers panel) or using an online header checker to confirm max-age=31536000 is present.
  6. Confirm no part of your site (checkout, account pages, APIs) is still served over plain HTTP, because HSTS only protects you if 100% of your content is HTTPS-capable.

Fix it on your platform

Pick your platform for the exact steps.

How to fix hsts max age too short on Shopify
  1. Shopify automatically handles HTTPS and HSTS for all storefronts — you cannot directly edit server response headers from the Shopify admin.
  2. Shopify's CDN (Fastly) sets HSTS on your behalf. If a scanner reports a short max-age, it may be reading a header injected by a third-party app or a custom Shopify Storefront/Hydrogen deployment.
  3. Check your installed apps (Admin → Apps) for any 'Security Headers', 'HTTP Headers', or 'CSP Manager' apps that may be overriding the HSTS header with a short max-age, and update or remove them.
  4. If you use Shopify Plus with a custom domain proxy or a headless front-end (Hydrogen/Oxygen), set the header at the Oxygen edge or your own CDN layer — see the Headless / Custom entry below.
  5. For Shopify-managed stores with no custom proxy, no action is required; Shopify's platform-level header is already compliant. Re-run the scan to confirm.
Full Shopify guide →Official Shopify docs ↗
How to fix hsts max age too short on Shopify Plus
  1. Same as standard Shopify for standard storefronts — HSTS is managed by Shopify's Fastly CDN.
  2. If your Shopify Plus store uses a headless Hydrogen storefront deployed on Oxygen, add the header in your server/entry.server.tsx (or .jsx) response: response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  3. If you route traffic through your own reverse proxy or Cloudflare in front of Shopify Plus, set the header at that layer (see Cloudflare steps in the Headless entry).
  4. Audit any installed Plus apps that manage security headers and update their max-age setting to 31536000.
Full Shopify Plus guide →Official Shopify Plus docs ↗
How to fix hsts max age too short on WooCommerce
  1. WooCommerce runs on WordPress; HSTS is set at the web server or plugin level, not inside WordPress itself.
  2. Recommended plugin approach: Install the 'Headers Security Advanced & HSTS WP' plugin (or 'HTTP Headers' by Davide Casali) from WordPress.org. In the plugin settings, set Strict-Transport-Security max-age to 31536000 and enable includeSubDomains if appropriate.
  3. Alternatively, if you manage your own Nginx server, add inside your HTTPS server block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; Then reload Nginx: sudo nginx -s reload
  4. For Apache, add to your VirtualHost block or .htaccess (inside <IfModule mod_headers.c>): Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Then restart Apache.
  5. If your host uses cPanel, go to cPanel → Security → ModSecurity or use the 'Headers' section in your hosting control panel to add the header.
  6. Verify by visiting your store and checking the response headers in browser DevTools → Network tab.
Full WooCommerce guide →Official WooCommerce docs ↗
How to fix hsts max age too short on BigCommerce
  1. BigCommerce manages HTTPS and core security headers at the platform level for standard storefronts — direct server-header editing is not available in the admin UI.
  2. If the scanner reports a short max-age on a BigCommerce storefront, check whether a third-party script injection or a custom header app is overriding the header.
  3. For BigCommerce headless storefronts (e.g. Next.js + BigCommerce GraphQL API), set the header in your Next.js next.config.js headers() function or at your CDN/hosting layer (Vercel, Netlify, Cloudflare).
  4. Raise a support ticket with BigCommerce if you believe the platform itself is serving max-age=86400 — they control the CDN configuration for managed storefronts.
  5. Contact your BigCommerce account manager (for Enterprise) to request a compliant HSTS header be applied at the edge.
Full BigCommerce guide →Official BigCommerce docs ↗
How to fix hsts max age too short on Wix
  1. Wix manages HTTPS and HSTS centrally; you cannot edit HTTP response headers directly from the Wix dashboard for standard sites.
  2. Ensure your Wix site has a connected custom domain and that 'Force HTTPS' is enabled: Wix Dashboard → Settings → Domains → click your domain → toggle 'Redirect to HTTPS' on.
  3. If the scanner flags a short max-age, it is a platform-level header set by Wix infrastructure. Contact Wix Support and cite the specific finding — Wix may update their platform headers.
  4. For Wix Headless (using Wix APIs with a custom front-end), set the HSTS header in your own hosting layer (e.g. Vercel, Netlify, or your Node.js server).
  5. There is no Wix Marketplace app that controls HSTS; the header must be managed at the infrastructure level.
Full Wix guide →Official Wix docs ↗
How to fix hsts max age too short on Wix Studio
  1. Same infrastructure as Wix — HSTS is set by Wix's CDN and cannot be modified from the Studio editor.
  2. Ensure HTTPS redirect is active: Wix Studio Dashboard → Settings → Domains → Redirect all traffic to HTTPS.
  3. For custom-code sites or Wix Headless projects built in Wix Studio, handle the header in your own server/hosting environment.
  4. Contact Wix Support to report and request an update to the platform-level HSTS max-age value.
Full Wix Studio guide →Official Wix Studio docs ↗
How to fix hsts max age too short on Squarespace
  1. Squarespace provides automatic SSL and controls HSTS at the infrastructure level — you cannot set custom HTTP headers from the Squarespace admin panel.
  2. Confirm SSL is enabled: Squarespace Admin → Settings → Security & SSL → ensure 'Secure (preferred)' mode is selected and 'HSTS' is toggled on if that option is available in your plan.
  3. If a scanner reports a short max-age, this is a Squarespace platform-level setting. Contact Squarespace Support with the specific header value and request they update it to max-age=31536000.
  4. For Squarespace Developer Platform sites or external domains proxied through Cloudflare in front of Squarespace, you can override/supplement the HSTS header at the Cloudflare level using a Transform Rule.
Full Squarespace guide →Official Squarespace docs ↗
How to fix hsts max age too short on Webflow
  1. Webflow hosts sites on its own CDN and manages HTTPS automatically. Custom HTTP response headers are available on CMS and Business plans and above.
  2. To set or update the HSTS header: Webflow Designer → Project Settings → Hosting → Custom Headers section (or 'HTTP Headers' tab depending on plan).
  3. Add a new response header: Name: Strict-Transport-Security Value: max-age=31536000; includeSubDomains
  4. If you already have an HSTS header entry with max-age=86400, edit that entry and replace the value with max-age=31536000; includeSubDomains.
  5. Publish the site after saving. Verify with browser DevTools → Network tab → response headers on any page request.
Full Webflow guide →Official Webflow docs ↗
How to fix hsts max age too short on Adobe Commerce (Magento)
  1. In the Magento Admin, navigate to Stores → Configuration → General → Web → Base URLs (Secure) and ensure 'Use Secure URLs on Storefront' and 'Use Secure URLs in Admin' are both set to Yes.
  2. HSTS itself must be set at the web server or Varnish/FastCGI layer, not inside Magento's admin UI.
  3. For Nginx, add inside your HTTPS server {} block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  4. For Apache, add to the VirtualHost or .htaccess: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  5. For Adobe Commerce Cloud (Magento Cloud), add the header in your .magento.app.yaml or via the Fastly service configuration in the Cloud Console under CDN → Headers.
  6. Clear Magento's full-page cache after the change: Admin → System → Cache Management → Flush Magento Cache. Verify headers with DevTools or curl -I https://yourdomain.com.
Full Adobe Commerce (Magento) guide →Official Adobe Commerce (Magento) docs ↗
How to fix hsts max age too short on Magento Open Source
  1. Same web-server approach as Adobe Commerce — set the header in Nginx or Apache config as described above.
  2. For Nginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; inside the server block for port 443.
  3. For Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" inside <VirtualHost *:443>.
  4. Reload the web server after saving: sudo systemctl reload nginx or sudo systemctl reload apache2.
  5. Flush Magento cache: php bin/magento cache:flush full_page. Verify headers in DevTools.
Full Magento Open Source guide →Official Magento Open Source docs ↗
How to fix hsts max age too short on PrestaShop
  1. PrestaShop itself does not manage HTTP security headers — they must be set at the web server level.
  2. For Apache hosting, add to your .htaccess file (in the PrestaShop root, after the RewriteEngine On line): <IfModule mod_headers.c> Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" </IfModule>
  3. For Nginx hosting, add inside your HTTPS server block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  4. Alternatively, use the PrestaShop module 'Security Headers' (available on PrestaShop Addons marketplace) which provides a UI to configure HSTS and other headers.
  5. Clear PrestaShop cache: Admin → Advanced Parameters → Performance → Clear cache. Verify with DevTools.
Full PrestaShop guide →Official PrestaShop docs ↗
How to fix hsts max age too short on OpenCart
  1. OpenCart does not control HTTP headers natively — configure at the web server level.
  2. For Apache, edit your .htaccess in the OpenCart root: <IfModule mod_headers.c> Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" </IfModule>
  3. For Nginx, add in your server {} block for HTTPS: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  4. Reload the web server and verify the header appears in DevTools or with curl -I https://yourdomain.com.
Full OpenCart guide →Official OpenCart docs ↗
How to fix hsts max age too short on Headless / Custom (I build in code)
  1. Set the header in your server framework or hosting platform — do not rely on meta tags (HSTS is a server-sent HTTP header only).
  2. Next.js (next.config.js): module.exports = { async headers() { return [{ source: '/(.*)', headers: [{ key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' }] }] } }
  3. Vercel (vercel.json): { "headers": [{ "source": "/(.*)", "headers": [{ "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains" }] }] }
  4. Netlify (_headers file in /public): /* Strict-Transport-Security: max-age=31536000; includeSubDomains
  5. Cloudflare (Transform Rules): Dashboard → your domain → Rules → Transform Rules → Modify Response Header → Add rule: Header name = Strict-Transport-Security, Value = max-age=31536000; includeSubDomains. Apply to all HTTPS requests.
  6. Nginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; inside the server block for port 443.
  7. Express.js (Node): Use the 'helmet' npm package — helmet() sets HSTS to max-age=15552000 by default; override with: app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true }));
Full Headless / Custom (I build in code) guide →Official Headless / Custom (I build in code) docs ↗
How to fix hsts max age too short on Ghost
  1. Ghost(Pro) manages HTTPS and headers automatically — contact Ghost support if a scanner reports a short max-age.
  2. Self-hosted Ghost: the header is set in your Nginx config managed by Ghost-CLI. Edit /etc/nginx/sites-available/your-domain.conf and add inside the HTTPS server block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; Then run: sudo nginx -t && sudo systemctl reload nginx.
Full Ghost guide →Official Ghost docs ↗
How to fix hsts max age too short on Drupal
  1. Install and configure the 'Security Kit' (SecKit) module: Admin → Extend → Install Security Kit.
  2. Go to Admin → Configuration → System → Security Kit → HTTP Strict Transport Security: set 'Max-Age' to 31536000 and check 'Include Subdomains' if appropriate. Save.
  3. Alternatively set the header at the Nginx or Apache layer as described in the generic steps above.
  4. Clear Drupal caches: Admin → Configuration → Performance → Clear all caches.
Full Drupal guide →Official Drupal docs ↗
How to fix hsts max age too short on WordPress.org
  1. WordPress core does not set HSTS — you must set it at the server or plugin level.
  2. Plugin method: Install 'Headers Security Advanced & HSTS WP' or 'HTTP Headers' from Plugins → Add New. Activate and navigate to the plugin's settings page. Enable Strict-Transport-Security and set max-age to 31536000 with includeSubDomains checked.
  3. Apache method: In your root .htaccess, inside a <IfModule mod_headers.c> block add: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  4. Nginx method: In your server {} block for port 443: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; — reload Nginx after saving.
  5. Verify at securityheaders.com.
Full WordPress.org guide →Official WordPress.org docs ↗
How to fix hsts max age too short on Cloudflare (CDN/proxy used with any platform)
  1. Log in to Cloudflare → select your domain.
  2. Go to SSL/TLS → Edge Certificates.
  3. Scroll to 'HTTP Strict Transport Security (HSTS)' and click 'Enable HSTS'.
  4. In the dialog, set Max Age Header to '12 months (31536000)', toggle 'Include Subdomains' on (if all subdomains use HTTPS), then click Save.
  5. Note: Do NOT enable 'Preload' until you have verified your entire domain and all subdomains are permanently on HTTPS — preload list inclusion is very difficult to reverse.
  6. Verify with securityheaders.com.
Full Cloudflare (CDN/proxy used with any platform) guide →

Does your site have this issue?

Run a free SEOLZ scan to find hsts max age too short — and every other issue — across your whole site in minutes.

Scan my site free

Frequently asked questions

What is Hsts max age too short?

HTTP Strict Transport Security (HSTS) is a security header your web server sends to browsers that says: "Only ever connect to this site over HTTPS — never plain HTTP." The `max-age` value inside that header tells the browser how many seconds to remember and enforce that rule. A value of 86400 means just one day — after 24 hours the browser forgets the instruction and could allow an unencrypted HTTP connection again. The industry standard is 31536000 (one full year), meaning the browser stays protected for 365 days after each visit.

Why does hsts max age too short matter?

A short max-age creates a real window of vulnerability every single day. If a visitor's browser cache expires and they visit your store over an insecure network (coffee shop Wi-Fi, hotel hotspot), an attacker can intercept that initial unencrypted HTTP request and steal login credentials, session cookies, or payment data — a classic SSL-stripping attack. Beyond security, Google has used HTTPS as a ranking signal since 2014 and continues to favor sites that implement it properly; a misconfigured HSTS header signals to security-aware crawlers and auditors that your HTTPS setup is incomplete. Short max-age values are also explicitly flagged by OWASP and browser preload-list requirements, and many enterprise buyers and compliance frameworks (PCI-DSS, SOC 2) require HSTS to be set correctly before approving a vendor.

How do I fix hsts max age too short?

Increase your HSTS max-age directive to at least 31536000 seconds (1 year) so browsers enforce HTTPS connections for a meaningful period.

Authoritative references

Related Security (OWASP) issues