HSTS max-age is too short
HSTS max-age is below 180 days (15552000 seconds). This scan flags anything shorter than that.
Why it matters
A short lifetime means the browser drops the HTTPS-only rule quickly, and the preload list expects a full year.
What to do
Set max-age=31536000 (one year).
Reference
HSTS max-age and directive syntax are defined by RFC 6797.