HSTS and PCI DSS Approved Scans
Updated: May 27
What is HSTS?
HSTS (HTTP Strict Transport Security) is a web security policy mechanism that helps websites enforce secure connections by requiring browsers to only interact with them over HTTPS, preventing insecure HTTP connections.
Why HSTS matters for HTTPS security?
HSTS protects users from certain types of attacks, such as man-in-the-middle (MITM) attacks and SSL stripping, which attempt to downgrade HTTPS connections to unencrypted HTTP. Once a website enables HSTS, the browser automatically upgrades all future requests to HTTPS, even if the user mistakenly types "http://" instead of "https://".
HSTS and PCI DSS approved scans:
The Program Guide (version 4.0) for PCI DSS ASVs uses CVSS (Common Vulnerability Scoring System) to rank vulnerabilities found by approved scans. According to the guide,
"any vulnerability with a CVSS base score of 4.0 or higher will result in a non-compliant scan report, and all such vulnerabilities must be remediated by the scan customer." (section 6.2.1, Vulnerability Categorization).
A missing HSTS vulnerability has a base score of 6.5 (CVSS 3) or 6.3 (CVSS v4), which can cause the scan to fail.
How to check HSTS yourself
If your scan shows that a host does not support HSTS, you can check it yourself using the nmap command:
nmap -p 443 -script http-security-headers <URL / IP address 00.00.00.00>
Good example:
>nmap -p 443 -script http-security-headers amazon.com
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-31 22:51 W. Europe Daylight Time
Nmap scan report for amazon.com (205.251.242.103)
Host is up (0.11s latency).
Other addresses for amazon.com (not scanned): 52.94.236.248 54.239.28.85
rDNS record for 205.251.242.103: s3-console-us-standard.console.aws.amazon.com
PORT STATE SERVICE
443/tcp open https
| http-security-headers:
| Strict_Transport_Security:
|_ Header: Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Nmap done: 1 IP address (1 host up) scanned in 6.12 seconds
Bad example:
>nmap -p 443 -script http-security-headers <Domain>
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-31 22:51 W. Europe Daylight Time
Nmap scan report for <Domain> (IP address)
Host is up (0.021s latency).
Other addresses for <Domain> (not scanned): ...
PORT STATE SERVICE
443/tcp open https
| http-security-headers:
| Strict_Transport_Security:
|_ HSTS not configured in HTTPS Server
Nmap done: 1 IP address (1 host up) scanned in 19.85 seconds
How to solve HSTS issues for PCI DSS scans:
Enable HSTS on the Web Server:
Note that HSTS should be set for your top-level domain (mydomain.com), and not only on a subdomain (like www.mydomain.com). Make sure to include the includeSubDomains directive.
Ensure TLS/SSL is Properly Configured:
Use strong TLS 1.2 or higher encryption.
Disable weak encryption protocols like SSL 3.0 and TLS 1.0.
Preload HSTS (Optional but Recommended):
Websites can submit their domain to Chrome’s HSTS preload list, ensuring that browsers enforce HTTPS before even making the first request.
Regularly Test Compliance:
Verify proper HSTS implementation.
Exceptions:
There are cases where the scanner does not see HSTS for a valid reason. In these cases, it may not be necessary to fix the scanned host. Instead, let us know the reason why HSTS is not applicable, and we can file it as an exception.
Examples of such exceptions:
The host is an API server only, so clients do not access it through web browsers.
The host was specified by an IP address and not a domain name (FQDN).
The best practice is to use a FQDN for scans, and not an IP address. In many cases, load balancers, WAF or other infrastructure elements will not serve IP address and will return an error page (eg. 404) with minimal headers, specifically without HSTS.
Also, when using hosts serving virtual sites, where multiple domains share the same IP address, the system may not know which site the request should be routed to, and you may end up not testing the intended site. Therefore, HSTS may work with the domain name but not with the IP address.
For organisations that need help handling HSTS findings or other scan vulnerabilities, nabu provides PCI DSS ASV scanning for internet-facing systems connected to payment environments.
Need help resolving HSTS issues before your next approved scan? Contact nabu to review the finding and remediation options.
