hsts

What is checked: http:// redirects to https://, and the HTTPS homepage sends a Strict-Transport-Security header with max-age of at least one year (RFC 6797).

Why it matters: without it, the first visit can be intercepted and kept on plain HTTP, for example on public Wi-Fi.

Smallest fix: redirect all HTTP requests to HTTPS (301), and add to every HTTPS response:

Strict-Transport-Security: max-age=31536000

Start with a short max-age (e.g. 86400) if you are unsure every subdomain supports HTTPS, then raise it. Add includeSubDomains only when all subdomains serve HTTPS.