Check · Security header
No HSTS (or lifetime too short)
What it means
The Strict-Transport-Security header is missing or expires quickly, so browsers may still try plain-HTTP connections.
Why it matters
Without HSTS a first request over HTTP can be intercepted and downgraded — the classic coffee-shop attack.
How to fix it
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once you're sure the whole app runs on HTTPS.
Does your app have this problem? The free passive check tests this and 4 more areas — no login, nothing touched.
Check your app free