Security compliance tools flag Auth0-hosted endpoints as non-compliant when the HTTP Strict Transport Security (HSTS) header lacks the preload directive. The header omits the preload directive because the directive only functions when administrators submit a domain and browser vendors accept it into the official HSTS Preload List. Security or compliance teams require this architectural explanation to close compliance findings.

• Auth0
• Auth0-hosted endpoints
• Custom domain subdomains

Security compliance tools flag Auth0-hosted endpoints as non-compliant when the HSTS header lacks the preload directive. The expected header format includes the directive:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

However, Auth0-hosted endpoints return the header without the directive:

Strict-Transport-Security: max-age=31536000; includeSubDomains

This omission occurs because the preload directive only functions when administrators submit a domain and browser vendors accept it into the official HSTS Preload List.

Why does Auth0 omit the preload directive from Auth0-hosted endpoints?

Auth0 cannot add the preload directive to Auth0-hosted endpoints for several architectural and functional reasons. Review the following reasons to explain the omission to security or compliance teams and close compliance findings related to the missing directive.

• Browser vendors accept HSTS Preload List submissions exclusively at the top-level domain level (e.g., <auth0.com>), not at subdomains (e.g., <tenant-name.auth0.com>).
• Auth0-hosted endpoints operate as subdomains, making them ineligible for Preload List submission.
• Including the preload directive on a domain not in the official Preload List provides no actual browser enforcement and creates a false sense of protection.
• Auth0 intentionally maintains this consistent behavior across all environments (development, quality assurance, user acceptance testing, and production).