As a web security specialist with more than two decades of experience advising Fortune 500 companies, I've seen the rise and fall of various HTTP security headers. Expect-CT is one such header that was once useful for enforcing Certificate Transparency (CT), but is now considered deprecated.
Expect-CT is a response header designed to instruct browsers to enforce and/or report Certificate Transparency compliance for TLS certificates. Certificate Transparency helps ensure that misissued or fraudulent certificates do not go undetected.
Only Chromium-based browsers ever supported strict enforcement of the Expect-CT header, and Chromium has deprecated this functionality since version 107.
Duration (in seconds) for which the browser should cache and enforce the policy.
Optional directive that makes the browser actively block connections that fail the CT check.
Optional URL where the browser sends failure reports for diagnosing CT compliance issues.
<IfModule mod_headers.c>
Header set Expect-CT "max-age=86400, enforce, report-uri=\"https://example.com/report\""
</IfModule>add_header Expect-CT "max-age=86400, enforce, report-uri=\"https://example.com/report\"";
<configuration>
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Expect-CT"
value="max-age=86400, enforce, report-uri="https://example.com/report"" />
</customHeaders>
</httpProtocol>
</system.webServer>
</configuration>Instead of using the deprecated Expect-CT header, consider implementing:
Learn about other HTTP security headers to strengthen your website's security: