Missing Strict-Transport-Security (HSTS)
The response did not include Strict-Transport-Security.
Why it matters
Without HSTS, a browser that is sent to http:// first can be intercepted before it ever reaches HTTPS.
What to do
Send Strict-Transport-Security with max-age=31536000 and includeSubDomains once every subdomain supports HTTPS.
Reference
HSTS instructs browsers to use HTTPS only for the host and defined subdomains.