id: missing-hsts
info:
  name: Strict Transport Security Not Enforced
  author: Dawid Czarnecki
  severity: info
  description: Checks if the HSTS is enabled by looking for Strict Transport Security response header.
  tags: misc

requests:
  - method: GET
    path:
      - '{{BaseURL}}'
    redirects: true
    matchers:
      - type: dsl
        dsl:
          - '!contains(tolower(all_headers), ''strict-transport-security'')'