ERT-CONFIG-002
Missing HSTS
MediumA02:2025CWE-319
Why it matters
Browsers may connect over plain HTTP first, which can be intercepted.
How to fix it
Send Strict-Transport-Security: max-age=63072000; includeSubDomains.
How we test it
Passive — runs in the free check, looks only at what a browser can see.