HSTS header does not meet ShipReady's max-age condition
The observed HSTS header lacked a scanner-recognised max-age of at least 15,768,000 seconds.
Why it matters
The max-age directive is part of an HSTS policy. Reviewing an observed value against an intentional policy helps catch a missing, malformed, or shorter-than-expected duration without making claims about current browser state.
How ShipReady detects it
What it inspects
ShipReady reads the non-empty Strict-Transport-Security header from a successfully fetched, readable, same-site content-serving 2xx final response.
What triggers a finding
The rule uses the first case-insensitive max-age directive whose value contains decimal digits. It triggers when no such value is found or when that value is below 15,768,000 seconds.
What the evidence shows
The observed HSTS value did not contain a scanner-recognised numeric max-age meeting the 15,768,000-second threshold.
Limits of this check
ShipReady uses a bounded pattern match, not complete HSTS grammar validation. It checks the final fetched response rather than redirect hops or every route, and does not inspect a browser's HSTS cache, history, or current protection state.
How to fix it
Set an intentional max-age
After confirming the domain is ready for HSTS, configure a valid max-age that meets the intended policy. ShipReady's threshold is 15,768,000 seconds.
Verify the generated header
Inspect the deployed final response header to confirm the intended numeric max-age is present and that proxy or CDN configuration has not changed it.
How to verify the change
Inspect the final HSTS header
Request representative deployed content URLs and inspect their final Strict-Transport-Security values.
Expected: The header contains the intended numeric max-age, at or above ShipReady's threshold when that policy is desired.