Security Policy Errors

How to Fix SharePoint Security Headers HSTS and Cache-Control Issues

Maira Mehtab Sep 20, 2026 869 views

Question details

A security scan flags that HTTP Strict Transport Security (HSTS) and Cache-Control headers are not securely implemented across SharePoint pages.

Product: SharePoint
Device & OS: not provided
Scenario: Running a security vulnerability scan or auditing HTTP headers on a SharePoint deployment.
Observed behavior: The scan reports insecure implementation of HSTS and Cache-Control headers, requiring different troubleshooting steps depending on whether the environment is SharePoint Server or SharePoint Online.

Before you start

Verify whether your organization uses SharePoint Server (on-premises) or SharePoint Online (cloud), as the resolution steps differ entirely based on the environment.

Solution 1Recommended

Gather Security Scan Details and Identify Environment

Determine your deployment model and compile the necessary logs to proceed with remediation.

Because SharePoint Online is a managed service and SharePoint Server is managed by your internal IT, the fix relies heavily on knowing which platform is hosting your pages.

Check your deployment type

Consult your IT administrator to confirm if your site is hosted on SharePoint Server (on-premises) or SharePoint Online (Microsoft 365).

Compile the security report

Export the full output from your security scanner detailing the missing HSTS and Cache-Control headers.

Document affected URLs

List the exact SharePoint URLs, the timestamps of the scan, and the steps to reproduce the vulnerability flag.

Solution 2

Seek Configuration Guidance for SharePoint Server

For on-premises deployments, server administrators can manually configure HTTP response headers via IIS.

Solution 3

Contact Microsoft Support for SharePoint Online

Since SharePoint Online restricts access to backend IIS settings, you must request assistance from Microsoft to address security header flags.

Free Microsoft Office alternative

Looking for a Secure and Free Office Suite?

While resolving SharePoint server configurations, if you need a lightweight and highly compatible suite for your daily document processing, consider WPS Office. It provides robust tools for word processing, spreadsheets, and presentations without the hefty subscription fees of Microsoft Office.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install the Suite: Run the installer and follow the on-screen instructions to set up the software in minutes.
3. Open Your Documents: Launch WPS Office and instantly open, edit, and save your existing Word, Excel, and PowerPoint files.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Lightweight design that runs smoothly on both older and modern devices.Built-in advanced PDF editing and secure cloud storage integration.Familiar user interface for seamless migration from other Office suites.

microsoft office alternative - wps office

Frequently Asked Questions

What is the HSTS header in SharePoint?

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps protect websites against man-in-the-middle attacks, such as protocol downgrade attacks and cookie hijacking, by forcing browsers to interact with the site only over secure HTTPS connections.

Can I manually add Cache-Control headers in SharePoint Online?

No, SharePoint Online is a managed cloud software-as-a-service (SaaS) environment. Users do not have direct access to the underlying IIS servers to modify global security response headers. You must contact Microsoft Support to address these specific scan findings.

How do I fix missing security headers in SharePoint Server?

In an on-premises SharePoint Server environment, administrators can typically add security headers like HSTS and Cache-Control manually through the Internet Information Services (IIS) Manager by modifying the HTTP Response Headers feature for the specific web application.

Microsoft Office Security Issues