What is HSTS and should my website use it?
HSTS, which stands for HTTP Strict Transport Security, is a header your server sends telling browsers to use https for your site for a set period without ever trying http first. It closes the small window in which a visitor's first request could be intercepted and downgraded. It is one line of configuration, and any site that already works fully over https should use it.
Why it matters
A redirect from http to https still starts with an insecure request. An attacker on the same network can answer that first request themselves and keep the visitor on a fake http version of the site. HSTS tells the browser to remember that the site is https-only, so after the first visit it never sends an insecure request again, and the attack has nothing to intercept.
The one caution
Once the header is set, browsers refuse http for the domain until the stated period expires. If any page or subdomain still needs http, it will stop working for returning visitors. So switch it on only after https is fully in place across the whole site, start with a short period such as a day, and increase it to a year once you are confident.
How to check
Our check looks for the Strict-Transport-Security header on your home page. In a browser's developer tools it appears in the response headers under the Network tab.
How to fix it
Ask your host or developer to add the header. A typical value is "max-age=31536000; includeSubDomains", meaning one year and including subdomains. On Apache it is one line in the .htaccess file; Cloudflare and most hosting panels have a switch for it; WordPress security plugins usually offer it. Do not add "preload" unless you understand its implications, because it cannot easily be undone.
Not sure how your own site does on this? Run the free check: it takes about twenty seconds and reports on this and thirty other things.