Strict-Transport-Security (HSTS) is present
The response includes Strict-Transport-Security, so browsers can be told to stay on HTTPS for this host.
Why it matters
HSTS is the control that turns an HTTPS visit into a standing rule. A present header still needs a long max-age to be useful.
What to do
Read the separate HSTS results for max-age, includeSubDomains, and preload. A header that exists can still be too short.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.