HTTP Strict Transport Security, or HSTS, is a way for a site to tell browsers that it should only ever be reached over a secure connection. It is switched on by one header. Once a browser has seen it, it will not load your site over plain http:// for the time you set, even if a visitor types the old address or follows an old link.
Strict-Transport-Security: max-age=31536000; includeSubDomainsWhy it matters
A redirect from http:// to https:// protects most visitors, but the first request still goes out unencrypted, and on a shared or hostile network that moment can be intercepted and the visitor sent elsewhere. HSTS closes that gap for every visit after the first, because the browser upgrades the request itself before anything is sent.
What Link Signals checks
A report on your own site says whether the secure version loads, whether http:// sends visitors to https://, and whether this header is set. These are summarised in one word.
| Label | Meaning |
|---|---|
| Problem | The secure version does not load, or its certificate is not trusted. |
| No redirect | https:// works, but http:// does not send visitors to it. |
| Good | Secure and redirected, but no HSTS header. |
| Strong | All three are in place. |
Each label comes with the next thing to fix. See check your domain and certificate.
Common misunderstandings
- HSTS does not replace the redirect. Browsers learn about it only after a first secure visit, so keep both.
- It is hard to undo. Once a browser has been told to use https for a year, it will refuse plain http until that time has passed. Be sure every part of the site works securely before you add
includeSubDomains. - The check does not look at preload lists, and it is about your own site only. Other sites you link to are not checked for HSTS.
Questions
Where do I set the header?
In your web server or CDN settings, or through a plugin if your site runs on a CMS. Your host’s support pages usually explain where.
Does HSTS affect search rankings?
Secure pages are a lightweight search signal, but the header is mainly a security measure. Link Signals reports it for the sake of your visitors.
How this counts in your LinkSignal
HSTS is not part of your site’s external LinkSignal. The HTTPS on your site row looks only at whether the secure version loads and whether http:// sends visitors on to https://. See the LinkSignal overview for the rows that are scored. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.
Run a scan and find where these show up on your own site.
