Discuss and resolve questions on Liquid, JavaScript, themes, sales channels, and site speed enhancements.
Hi Community,
We ran a PCI scan and the store got the following failure, and would like help to input the correct response as Shopify is PCI compliant.
Web (2053/tcp)
HSTS Missing From HTTPS Server (RFC 6797)
Synopsis
The remote web server is not enforcing HSTS, as defined by RFC 6797.
Description
The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
Output
The remote HTTPS server does not send the HTTP
"Strict-Transport-Security" header.
Solved! Go to the solution
This is an accepted solution.
Hi jaykappa!
I have seen this before. Some ASVs do things a little different.
The finding is: the server on port 2053 is not enforcing HSTS.
Unfortunately, at this time, we can not control the content on port 2053. This content is served by the Cloudflare CDN.
Good news is that all content on port 2053 (and a few other ports) is OUT OF SCOPE.
The finding is on a port that is forward to a network outside of the scope of this test (Cloudflare CDN error message content).
That should give you enough info to report the finding as a false positive to the ASV Scanner.
Thanks,
Shawn.
To learn more visit the Shopify Help Center or the Community Blog.
This is an accepted solution.
Hi jaykappa!
I have seen this before. Some ASVs do things a little different.
The finding is: the server on port 2053 is not enforcing HSTS.
Unfortunately, at this time, we can not control the content on port 2053. This content is served by the Cloudflare CDN.
Good news is that all content on port 2053 (and a few other ports) is OUT OF SCOPE.
The finding is on a port that is forward to a network outside of the scope of this test (Cloudflare CDN error message content).
That should give you enough info to report the finding as a false positive to the ASV Scanner.
Thanks,
Shawn.
To learn more visit the Shopify Help Center or the Community Blog.
Learn how to build powerful custom workflows in Shopify Flow with expert guidance from ...
By Jacqui May 7, 2025Did You Know? May is named after Maia, the Roman goddess of growth and flourishing! ...
By JasonH May 2, 2025Discover opportunities to improve SEO with new guidance available from Shopify’s growth...
By Jacqui May 1, 2025