ShipworkSite inspection
Checks
Every error, explainedGuides →
Pricing Learn Guides

Is the connection itself as strong as it should be?

These are the signals set once and never revisited. HSTS stops a first visit being downgraded. Preload closes the very first window. DNSSEC stops DNS spoofing. HTTP/3 is the fastest transport generally available.

Runs the free audit, which includes this check where it applies to your site. Nothing is stored.

What this check inspects

Shipwork reads the Strict-Transport-Security header and its directives, checks the domain against the HSTS preload status service, looks for an alt-svc header advertising HTTP/3, and queries a public DNS-over-HTTPS resolver for a DS record to determine whether DNSSEC is enabled.

What a failure means

No HSTS is a warning: a first visit can be downgraded to http. HSTS without preload or without includeSubDomains is informational, since there is still a gap. HTTP/3 not advertised and DNSSEC not enabled are informational. None of these are page-level errors, but each is a real protection left off.

How to fix it

  1. Enable HSTS with a long max-age, then add includeSubDomains once every subdomain is https.
  2. Submit the domain to the HSTS preload list once HSTS is stable.
  3. Enable DNSSEC at your registrar and at your DNS provider, and publish the DS record.
  4. Check whether your CDN or host supports HTTP/3 and turn it on where available.

A typical failure, worked through

The setupA store enables HSTS but not includeSubDomains, and a shop subdomain that only serves http is added six months later.

What the check reportsThe check reports HSTS present without includeSubDomains, and no preload. The main host is protected, but the subdomain remains a downgrade path.

The pointHSTS without includeSubDomains protects the host and nothing below it. Decide subdomain coverage deliberately rather than by omission.

Questions

What does HSTS actually prevent?
It tells the browser to use https for the domain for a set period, which closes the window where an attacker could downgrade the first request to http.
What is the HSTS preload list?
A list of domains hard-coded into browsers, so even the very first visit uses https without contacting the site over http. Inclusion is deliberately hard to reverse.
Does DNSSEC speed anything up?
No. It prevents a class of attack where a forged DNS response sends a visitor somewhere else. It is a trust measure, not a performance one.

Related checks and guides