OWASPASVS 5.0 requirement
ASVS-V3.7.4 The application's top-level domain (e.g., site.tld) is added to the public preload list for http strict transport security (hsts).
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.7 Other Browser Security Considerations
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that the application's top-level domain (e.g., site.tld) is added to the public preload list for HTTP Strict Transport Security (HSTS). This ensures that the use of TLS for the application is built directly into the main browsers, rather than relying only on the Strict-Transport-Security response header field.