HSTS header missing

Low priorityTechnical

The site doesn’t send a Strict-Transport-Security header, so browsers may still try HTTP first.

What triggers this issue

• No Strict-Transport-Security header on the HTTPS response.

Why it matters

Even with a redirect, a visitor’s first request can go over HTTP, where it can be intercepted. HSTS tells browsers to always use HTTPS for your site, closing that gap.

How to fix it

1. Send the header from your server or CDN once HTTPS works everywhere, including subdomains if you use includeSubDomains.
2. Start with a short max-age (a day) and increase it once you’re confident.

Strict-Transport-Security: max-age=31536000; includeSubDomains