Logins can travel over plain HTTP

Play this card on https://example.com. Everything a developer (or your AI agent) needs to fix and verify it — free. Fixing your own site is never paywalled.

visibilityCard text — what this means

Demo public response headers do not include Strict-Transport-Security.

HSTS tells browsers to keep using HTTPS for the domain and reduces downgrade or accidental insecure navigation risk.

Preview ingestion only checks sanitized response headers and does not crawl subdomains.

playing_cardsHow to play it

Add a Strict-Transport-Security header after confirming the service is consistently available over HTTPS.

1Confirm the production domain and required subdomains serve HTTPS correctly.
2Start with an HSTS max-age appropriate for the rollout risk.
3Increase max-age and consider includeSubDomains only after validating subdomain readiness.

Fix it on your stack

nginx

# in your server { } block
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

infoOnly add this once the site is reliably served over HTTPS, including subdomains.

workspace_premiumClaim your relic

Sanitized response headers showing Strict-Transport-Security on the public target.

Evidence needed: Sanitized response headers showing Strict-Transport-Security on the public target.

Related controls

Readiness mapping only — evidence relevant to these controls. Pazmo does not determine, certify, or guarantee compliance.

A.8.24 · Use of cryptography (ISO/IEC 27001:2022)
CC6.7 · Transmission and movement of information (SOC 2)

Transport securityVendor readiness

smart_toyHand this card to your AI agent Back to your run