Always-secure instruction (HSTS)
Domain & Security
Technical
Your site does not tell browsers to always use the secure connection.
Why it matters: Without this instruction, a browser may still try the insecure address first, which leaves room for the connection to be tampered with.
How to fix it: Ask your developer or host to add the Strict-Transport-Security header once HTTPS works on every page.
Security headers
Domain & Security
Technical
Your site sends 0 of the 5 security headers we look for; missing: hsts, csp, x_frame_options, x_content_type_options, referrer_policy.
Why it matters: These headers tell browsers how to protect visitors - for example, stopping your pages being framed inside someone else's site.
How to fix it: Ask your developer or host to add the missing headers in the server or hosting settings.