HSTS header missing

Check id: hdr.hsts_missing · fix effort: medium

What it means

Browsers aren't told to always use encryption with your site, which leaves returning visitors open to downgrade tricks. One header fixes it.

The technical detail

No Strict-Transport-Security on the HTTPS response. Send max-age=31536000 with includeSubDomains once all subdomains serve HTTPS.

How to fix it

1. Send Strict-Transport-Security: max-age=31536000; includeSubDomains (add preload once confident).
2. Confirm all subdomains serve HTTPS before includeSubDomains.