HSTS header is present with reasonable max-age

HTTPS enforcement prevents plaintext connections, but HSTS goes further: it instructs the browser to refuse HTTP for your domain entirely for up to a year after the first visit, eliminating SSL-stripping attacks that can silently downgrade an HTTPS connection before the browser even sees it. Without a max-age of at least 31536000, an attacker who intercepts the first request can strip the redirect and operate in plaintext for every subsequent session. RFC 6797 defines the spec; OWASP A02 identifies the absence of HSTS as a cryptographic failure that enables credential theft.

Configure the Strict-Transport-Security header with a full-year max-age in your framework config or middleware. A short max-age is nearly as dangerous as no HSTS — browsers forget the policy quickly.

// next.config.js
headers: [{
  key: 'Strict-Transport-Security',
  value: 'max-age=31536000; includeSubDomains'
}]

Verify the header is live with curl -I https://yoursite.com | grep Strict-Transport after deployment. Do not configure this only in development environments — production config is what matters.