Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

High

Strict-Transport-Security (HSTS)

Forces browsers to connect to your site exclusively over HTTPS, preventing protocol downgrade attacks and cookie hijacking.

Risk

Without HSTS, an attacker on the same network (public Wi-Fi, corporate network) can intercept the initial HTTP connection and redirect users to a malicious version of your site. This is known as a man-in-the-middle (MITM) attack. Session cookies, credentials, and personal data can be stolen in transit.

Solution

Add the Strict-Transport-Security header to your server responses. Start with a short max-age for testing, then increase it once confirmed working. Include subdomains and consider preloading.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

MDN - Strict-Transport-Security HSTS Preload List

Comments (0)

No messages yet.