Check ID: zone_hsts_enabled
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: encryption, internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for HTTP Strict Transport Security (HSTS) by checking if it is enabled with a max-age of at least 6 months (15768000 seconds) and includes subdomains to instruct browsers to always use HTTPS across the entire domain.

​
Risk

Without HSTS, browsers may initially connect over HTTP before redirecting to HTTPS.
  • Confidentiality: creates a window for SSL stripping attacks where attackers downgrade connections to unencrypted HTTP
  • Integrity: first request can be intercepted and modified before HTTPS redirect
  • Session hijacking: cookies and credentials may be captured during initial HTTP request

​
Recommendation

Enable HSTS with at least a 6-month max-age (12 months recommended).
  • Verify all resources work over HTTPS before enabling
  • Enable include_subdomains to protect all subdomains
  • Consider HSTS preloading for maximum protection against SSL stripping attacks
  • Test thoroughly as HSTS cannot be easily disabled once deployed

​
Remediation

# Enable HSTS with recommended settings
resource "cloudflare_zone_setting" "security_header" {
  zone_id    = "<ZONE_ID>"
  setting_id = "security_header"
  value = {
    strict_transport_security = {
      enabled            = true
      max_age            = 31536000  # Critical: 1 year in seconds
      include_subdomains = true      # Recommended: apply to all subdomains
      preload            = true      # Recommended: submit to browser preload lists
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_hsts_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks