Checks

Missing Strict-Transport-Security (HSTS)

The response did not include Strict-Transport-Security.

Why it matters

Without HSTS, a browser that is sent to http:// first can be intercepted before it ever reaches HTTPS.

What to do

Send Strict-Transport-Security with max-age=31536000 and includeSubDomains once every subdomain supports HTTPS.

Reference

HSTS instructs browsers to use HTTPS only for the host and defined subdomains.

MDN — Strict-Transport-Security