chromium/hstspreload.org

`Strict-Transport-Security` header detected incorrectly

Closed this issue · 2 comments

Big-Cake-jpg commented

Domain lihaoyu.cn has Strict-Transport-Security: max-age=31536000;includeSubDomains;preload header, but hstspreload.org said that this domain doesn't have any HSTS header.
image
image

Meanwhile, www.lihaoyu.cn is normal.
image

lgarron commented

but hstspreload.org said that this domain doesn't have any HSTS header.

Checking the response for https://lihaoyu.cn in Chrome DevTools and cURL/HTTPie, that looks correct. The site needs to resume sending the header to stay preloaded.

nharper commented

I concur with @lgarron's assessment. This appears to be a configuration issue with the website, not an issue with hstspreload.org. One possible explanation for why lgarron, hstspreload.org, and I don't see the HSTS header is that it's possible that the website only sends the HSTS header under some conditions.