HSTS

What this check looks for

For sites served over HTTPS, this check reads the homepage's Strict-Transport-Security response header. If absent, it warns. If present, it parses the max-age directive; a value under 15,552,000 seconds (180 days) warns as too short, while 180 days or more passes. Sites not on HTTPS report "na", since HSTS doesn't apply.

Why it matters

Without HSTS, a browser that's told to visit http://yoursite.com will make that initial plain-HTTP request before any redirect to HTTPS can happen, leaving a brief window where an attacker on the network can intercept or redirect that first request — HSTS closes this gap by telling the browser to rewrite every future request to HTTPS automatically, without ever touching the network in plain HTTP. A short max-age means that protection expires quickly if the header isn't refreshed on every response, effectively reopening the same window. This is a security hardening measure rather than a direct ranking factor, but it reinforces the same HTTPS trust signal search engines and AI crawlers already weigh, and it protects the traffic your rankings are meant to earn.

How to fix it

Send a Strict-Transport-Security header with at least a one-year max-age on every HTTPS response:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Add includeSubDomains if every subdomain is also served over HTTPS, and consider preload submission once you're confident the policy is stable sitewide.