Missing HSTS: what it means and how to fix it

What we look for

These https:// pages are served without a Strict-Transport-Security header (HSTS, a rule telling browsers to use only HTTPS for this site from then on).

Why it matters

Without it, a visitor's first request can go over insecure HTTP, where it could be intercepted. It protects visitors but does not affect search results, so it costs no points.

How to fix

Add a Strict-Transport-Security header with a max-age of at least a year in your server, CDN or hosting settings, once the whole site works over HTTPS.

Where you’ll see it

The id is stable, and every surface uses it, so it’s the thing to search for or hand to an agent.

Terminal: When it is one of the five findings under Fix first, raptor crawl prints the id under it.
Check: security.missing_hsts
crawl.json and the CSV: The crawl JSON names the finding by this id, and so do the CSV and raptor_query.
"check_id": "security.missing_hsts"
The HTML report: This link opens the finding in the report, and each finding shows its id.
crawl.html#finding=security.missing_hsts
MCP: raptor_findings with this check_id returns the finding in full, with a fix brief ready to paste into a task. If it didn’t fire, it says why.
raptor_findings { "job_id": "...", "check_id": "security.missing_hsts" }