Audit rules
HSTS Missing
The https page has no Strict-Transport-Security header, or its max-age is missing or 0. In a QuikSEO audit, a failure of this rule has info severity and counts against the score. Below are the exact condition, its exceptions and the sources behind it, followed by the other rules of the same group.
security.hstsInfo01 — Definition
How This Rule Is Checked
The rule is a pure function of the fetched page: no extra requests, no account settings. The same input always gives the same result.
Rule Severity and Score
- Rule id
security.hsts- Group
- Security
- Severity of a failure
- Info
- Counts in the score
- Yes, whenever it applies to the page
- Required for a score
- No
- Replaces the check
hsts
Condition and Exceptions
- Condition
- https page without Strict-Transport-Security, or with max-age missing or 0 → fail (info)
- Exceptions
- http page → not_applicable
Sources
02 — Security
Other Rules in This Group
The other checks of the same group, each with its own condition and sources.
- X-Content-Type-Options Missingsecurity.content_type_options
- Content Security Policy Missingsecurity.csp
- Framing Protection Missingsecurity.frame_protection
- Permissions Policy Missingsecurity.permissions_policy
- Referrer Policy Missingsecurity.referrer_policy
- Flagged by Safe Browsingsecurity.safe_browsing
- Form Submits Over HTTPsecurity.unsafe_forms