ShipPatrolScan your site for legal, security and SEO gaps, then fix them
SecurityUsually medium

HSTS checker: does your site send Strict-Transport-Security?

HSTS tells browsers to only ever use HTTPS for your site, even if someone types http://. ShipPatrol checks your headers for it.

Why it matters

Without HSTS, the first request to your site can go over plain http and be intercepted before the redirect happens. With it, the browser never tries.

How Patch checks

We read the Strict-Transport-Security header on your homepage and check its max-age is at least six months (15768000 seconds).

How to fix it

  1. Add the header: Strict-Transport-Security: max-age=31536000; includeSubDomains
  2. Only add includeSubDomains if every subdomain of your site serves HTTPS.
  3. Most hosts let you set this in a headers file (for example staticwebapp.config.json, vercel.json, netlify.toml or _headers).

Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.

Where this applies

Good security practice everywhere.

Free scan

Check this on your site.

Patch runs "No HSTS header" along with every other check, from the UK, the EU and the US. Free, no signup.

No signup needed. Not legal advice; every check names its source.

All checks