HSTS-MISSING
No HTTP Strict Transport Security
What it means
HSTS tells browsers to use HTTPS automatically for future visits, closing the window where a first plain-HTTP request can be intercepted.
How to fix it
- 1Once HTTPS works everywhere, send Strict-Transport-Security: max-age=31536000; includeSubDomains.
Re-check after the change
DNS changes can take up to the record's TTL to be seen; use Re-run on the result page to bypass our 10-minute cache.