Header: Expect-CT
Purpose: Enforces Certificate Transparency
Severity if Missing: Medium
Complexity: Easy
Status:
Configuration (Historical):
Expect-CT: enforce, max-age=86400
Expect-CT required browsers to check that SSL/TLS certificates appear in public Certificate Transparency logs, helping detect rogue certificates issued by compromised Certificate Authorities.
Important: This header is deprecated. Certificate Transparency is now mandatory in modern browsers and doesn't require this header.
Chrome 107+ (October 2022): Header ignored Modern browsers: CT enforced automatically
Migration: Remove header or keep for legacy browser support (no harm).
Directives:
enforce- Block connections if CT requirement not metmax-age=<seconds>- How long to remember policyreport-uri=<url>- Where to send violation reports
Before CT:
- Compromised CA could issue fraudulent certificate
- No public record of issuance
- Man-in-the-middle attacks possible
With CT:
- All certificates must be logged publicly
- Domain owners can monitor for unauthorized certificates
- Rogue certificates quickly detected
Expect-CT: enforce, max-age=86400, report-uri="https://example.com/ct-report"
(Remove header - no longer needed)
Modern browsers enforce CT automatically.
1. Still Adding to New Sites Not necessary for modern browsers.
2. Using without enforce
Expect-CT: max-age=86400 # Report-only mode
Didn't provide protection, only monitoring.
Old:
Expect-CT: enforce, max-age=86400New:
(Remove header)Certificate Transparency now built into browsers.
| Browser | Support | Status |
|---|---|---|
| Chrome | 61-106 | Deprecated |
| Firefox | Never | Not implemented |
| Safari | Never | Not implemented |
- HSTS - Still active and important
- Certificate Transparency
Last Updated: 2025-12-12 Status: Deprecated Recommendation: Remove from new deployments