HSTS header missing

HSTS instructs the browser to load your site over an encrypted connection only. Without this header the very first request often still goes over plain http — and that single moment can be intercepted and redirected on foreign networks.

In practice this is the difference between “we have a certificate” and “the connection is actually protected”. A certificate alone does not help if the browser never tries to use it.

The fix is a single header and takes minutes in any common hosting environment. Start with a short max-age, confirm everything stays reachable over https, then raise it.