Quick answer
HSTS (Strict-Transport-Security) tells a browser to use HTTPS for a host for a period of time. NOTABIS reports hsts-review when a sampled final HTTPS response has no non-empty HSTS header. This is a security configuration review outside the SEO score; set it only after confirming every intended subdomain and deployment path supports HTTPS.
What the issue means
A typical header is:
Strict-Transport-Security: max-age=31536000
includeSubDomains extends the policy to subdomains, and preload has additional operational requirements. HSTS is received over HTTPS; sending it on an HTTP response does not protect the first insecure visit.
Why it matters for SEO
HSTS is not a Google ranking requirement. It can reduce downgrade and mixed-content risk and support a consistent secure experience, while an incorrect policy can make a hostname unreachable after a certificate or subdomain mistake. Treat the finding as site health, not a reason to change URLs or scoring blindly.
How NOTABIS detects it
The hsts-review rule is created at origin scope when the security-header evaluation sees no non-empty strict-transport-security value on the sampled final HTTPS response. HSTS is marked not measured for a final HTTP URL. NOTABIS does not validate directives, certificate coverage, preload status, or all subdomains; it evaluates the final GET response it observed.
How to check it yourself
Request both HTTP and HTTPS endpoints and inspect the final response:
curl -sS -I https://example.com/
Check redirects, certificates, subdomains, CDN headers, and whether the header is stripped or added at one layer only. Test the policy in a staging environment before increasing max-age.
How to fix it
Serve all intended public hosts over HTTPS, then add an HSTS header with a carefully chosen max-age. Add includeSubDomains only when every covered subdomain is ready, and treat preload as a separate commitment with its published requirements. Recheck the final public response after CDN and proxy changes.
When this is intentional or does not need fixing
An HTTP-only development host, a mixed legacy estate, or a site that cannot guarantee HTTPS for every subdomain may need a staged rollout. Do not enable includeSubDomains or preload before validating certificates and redirects. Absence of HSTS does not make an SEO audit invalid.
Related issues
Compare missing security headers, mixed content, and HTTPS availability. HSTS behaviour is defined by RFC 6797.
Run a NOTABIS audit
NOTABIS records the sampled final response and whether a non-empty HSTS header was observed, keeping this security review separate from SEO scoring.