HSTS (Strict-Transport-Security)

P2W · 2026-08-07T13:17:06+00:00

Hi Pascal seit ich meine Kundenwebseiten mit HTProtect Tool schütze, habe ich das Problem das wenn ich ein Check auf https://hstspreload.org/ mache, bekomme ich bei einige 1* Error: No HSTS headerResponse (error: No HSTS header is present on the response) und einige 2* Error: No preload directive (The header must contain the preload directive). Muss dazu sagen dass bei alle meine Webseiten HSTS eigentlich durch den Joomla Plugins: System - HTTP Headers gesteuert ist. Wenn ich im HTProtect Tool unter Response headers HSTS einschalte bekomme ich die Fehlermeldung 1* wenn es im HTProtect Tool ausgeschaltet bleibt bekomme ich die Fehlermeldung 2* Hast du ein Tip woran es liegen könnte? P2W

P2W

Hi Pascal
Since I started protecting my clients' websites with the HTProtect tool, I’ve run into an issue: when I run a check on https://hstspreload.org/, I get some 1* Errors: No HSTS headerResponse (error: No HSTS header is present on the response) and some 2* Errors: No preload directive (The header must contain the preload directive).

I should mention that on all my sites, HSTS is actually managed by the Joomla plugin: System - HTTP Headers.
If I enable HSTS under Response headers in the HTProtect tool, I get the 1* error; if I leave it disabled there, I get the 2* error.

Any idea what might be causing this?
P2W

Pascal

Hi P2W,

hstspreload.org doesn’t check if HSTS is working, it only checks if a domain qualifies for the (optional) browser preload list. Your HSTS protection is active.

The key thing is that HSTS comes from one source, not two. The easiest for you: stick with the System - HTTP Headers plugin you’re already using, and just leave the "Enable HSTS" switch off in HTProtect. That way, HTProtect won’t touch the HSTS header at all – it won’t overwrite or remove anything, the plugin handles HSTS alone. No conflicts. (By the way: Joomla’s default .htaccess doesn’t set HSTS itself – so the header only comes from the plugin anyway.)

The "No preload directive" message isn’t really a problem. Preload is a nearly irreversible commitment (your domain gets locked into browsers, undoing it takes months, and all subdomains must permanently serve HTTPS). Only if you really want to get your domain on the preload list should you enable the options for subdomains and preload in the plugin’s HSTS settings (the max-age is already set to 1 year there).

Cheers
Pascal