# HTTP Strict Transport Security header not present on custom domain **URL:** \ **Category:** Get Help\ **Tags:** security-compliance, security-question-concern\ **Created:** [March 1, 2023, 1:19pm UTC](https://community.auth0.com/t/http-strict-transport-security-header-not-present-on-custom-domain/101546 "2023-03-01T13:19:51Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![pangratios](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pangratios/32/45030_2.png) [@pangratios](https://community.auth0.com/u/pangratios)\ **Post date:** [March 1, 2023, 1:19pm UTC](https://community.auth0.com/t/http-strict-transport-security-header-not-present-on-custom-domain/101546/1 "2023-03-01T13:19:51Z")
Hello, our security audit flagged this vulnerability for our custom domain we have setup with Auth0: **Web Server has HSTS Disabled** Upon manual inspection, I can see that the HTTP Strict Transport Security header is missing when accessing the configured custom domain. Is there something I can do to fix this? Thanks! ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [March 1, 2023, 8:19pm UTC](https://community.auth0.com/t/http-strict-transport-security-header-not-present-on-custom-domain/101546/2 "2023-03-01T20:19:43Z")
Hey there @pangratios welcome to the community! > [@pangratios](#): > > Upon manual inspection, I can see that the HTTP Strict Transport Security header is missing when accessing the configured custom domain. Is there something I can do to fix this? Interesting, this is the first I’ve ever heard this and can’t find anything where this has occurred elsewhere 🤔 I have come across issues regarding the preload directive, but nothing in regards to the header missing altogether. Are you able to doublecheck this again to confirm, and share any information as evidence to this being the case? A [har file](https://auth0.com/docs/troubleshoot/troubleshooting-tools/generate-and-analyze-har-files) could do the trick (feel free to DM me the file). Keep us posted! ---
**Author:** ![pangratios](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pangratios/32/45030_2.png) [@pangratios](https://community.auth0.com/u/pangratios)\ **Post date:** [March 2, 2023, 2:55pm UTC](https://community.auth0.com/t/http-strict-transport-security-header-not-present-on-custom-domain/101546/4 "2023-03-02T14:55:27Z")
Hey, I checked again today and now I can see the HSTS header. I asked our security auditors to check once more and get back to me. But we can consider this as closed. Thanks! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 16, 2023, 2:56pm UTC](https://community.auth0.com/t/http-strict-transport-security-header-not-present-on-custom-domain/101546/5 "2023-03-16T14:56:06Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.