Common Strict Transport Security mistakes that still ship

What an outsider sees on the public surface is simple: either the HTTPS response carried a Strict-Transport-Security instruction or it did not. Fancy migration decks do not change that header.

SlaySlop's check "Checks whether browsers are instructed to keep future requests on HTTPS." The mistakes below are how teams still fail that public-surface test while pointing at a redirect rule like it was policy.

Outcome if you fix these early

Fewer handoff calls where someone confuses a 301 with HSTS. Tickets that name hosts. Fewer includeSubDomains surprises on forgotten staging names. A habit of reading the header text instead of celebrating that "HTTPS works."

Boundaries

Public read-only scanning. Permission required. Not a pentest. HSTS ≠ SSL certificate ("Reviews certificate validity and public trust signals."). ≠ TLS configuration ("Inspects the public transport configuration and supported connection behavior."). ≠ CSP ("Checks whether browser content sources are restricted by a CSP header."). ≠ Frame protection ("Looks for controls that prevent unwanted framing and clickjacking."). SlaySlop will not rewrite your CDN config.

Happy path: mistakes I still see

Mistake 1: Blog has HSTS, checkout does not

Marketing pages get the header review because they were in the first QA pass. Checkout rides a different edge path and ships bare. Outsiders notice the money path first.

Mistake 2: Redirect sold as HSTS

A permanent redirect from HTTP to HTTPS is useful. It is not the same as instructing browsers to keep future requests on HTTPS via Strict-Transport-Security. Label them separately in tickets.

curl -sI "http://www.example.com/" | rg -i '^HTTP/|^location/'
curl -sI "https://www.example.com/" | rg -i '^HTTP/|^strict-transport-security'

Mistake 3: includeSubDomains without an inventory

Turning on includeSubDomains because a checklist said so can pin browsers to HTTPS expectations across sibling hosts you forgot were still HTTP-only experiments. Inventory first. Subdomains discovery exists for a reason on the public surface.

Mistake 4: Tiny max-age as "done"

A header with a trivial max-age can satisfy "we set HSTS" in a standup while doing almost nothing durable for returning browsers. Read the value. Decide intentionally.

hsts_mistake_log:
  host:
  symptom: missing|redirect-theater|includeSubDomains-surprise|tiny-max-age|host-gap
  evidence: curl|slayslop
  fix_owner:

Pitfalls in interpreting results

Treating preload tokens as proof of preload acceptance. Ignoring certificate failures while celebrating HSTS. Verifying only from a browser that already stored an old policy. Inventing severity scores or prices in the writeup.

Related next step

Fix the header on every launch host, rescan, then confirm SSL certificate still reads clean. Soft link: Strict Transport Security. Soft close: a permissioned SlaySlop report keeps the header finding next to the rest of the public surface an outsider sees.

What I refuse to invent

I do not invent prices, customer counts, or scan durations. I do not invent check names that are not on slayslop.com. I do not turn a read-only public finding into exploit steps. When the glossary sentence is narrow, the article stays narrow: observe the public signal, fix the config that produces it, rescan with permission, and keep sibling checks labeled as siblings.