Methodology
HSTS
ia.hsts · 5.3
Read
MUST
Recommendation
Why it matters
HSTS prevents protocol downgrade attacks by telling browsers to always use HTTPS. AI agents that follow redirects benefit from HSTS as it eliminates insecure initial connections.
How to fix it
Send Strict-Transport-Security with a max-age of at least one year.
-
Add the Strict-Transport-Security header to all HTTPS responses.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Verify
curl -sI https://{domain}/
Expected: A Strict-Transport-Security header with max-age=31536000 or higher
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.hsts
Details Mapping, lifecycle and references
- AR mapping
- No AR practice
- Evidence source
- MDN: Strict-Transport-Security
- Score role
- Core
- Introduced
- 2026-08-24
- Methodology version
- 2026-10-22