{"id":"ia.hsts","name":"HSTS","verify":{"command":"curl -sI https://{domain}/","rescan":"isagentready results {domain} --checkpoint ia.hsts","expect":"A Strict-Transport-Security header with max-age=31536000 or higher"},"fix":{"steps":[{"action":"Add the Strict-Transport-Security header to all HTTPS responses.","order":1,"language":"nginx","code_example":"add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"}],"summary":"Send Strict-Transport-Security with a max-age of at least one year.","skill":{"name":"security-trust","anchor":"ia.hsts"}},"category":"security","aggregate":null,"references":[{"title":"MDN: Strict-Transport-Security","kind":"guide","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security"},{"title":"HSTS Preload List","kind":"guide","url":"https://hstspreload.org/"}],"stage":"read","lifecycle":{"introduced":"2026-08-24","revised":[],"retired":null,"replaced_by":null},"methodology_version":"2026-10-22","evidence_tier":"standard","evidence_source":{"title":"MDN: Strict-Transport-Security","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security"},"why":"HSTS prevents protocol downgrade attacks by telling browsers to always use HTTPS. AI agents that follow redirects benefit from HSTS as it eliminates insecure initial connections.","profiles":["browser_agent_usability","api_tool_readiness","agentic_commerce"],"score_role":"core","legacy_id":"5.3","i18n":{"nl":{"name":"HSTS","steps":["Voeg de Strict-Transport-Security-header toe aan alle HTTPS-responses."],"why":"HSTS voorkomt downgrade-aanvallen door browsers te vertellen altijd HTTPS te gebruiken. AI-agents die redirects volgen, hebben er baat bij omdat de eerste onveilige verbinding verdwijnt.","fix_summary":"Stuur Strict-Transport-Security met een max-age van minimaal een jaar.","verify_expect":"Een Strict-Transport-Security-header met max-age=31536000 of hoger"}},"ar_practice_ids":[],"strength":"MUST","ar_mapping":"none","evidence_type":"recommendation","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.hsts","maturity":"essential","applicability":{"mode":"always","condition":null,"surfaces":["website"]}}