Strict-Transport-Security
Forces browsers to only ever connect to your site over HTTPS, even if a user types "http://" or follows an old link.
What it does
Strict-Transport-Security (HSTS) tells the browser: "remember this domain, and for the next max-age seconds, never load it over plain HTTP again: rewrite every request to HTTPS before it even leaves the browser."
Without it, the very first request a returning visitor makes could still go out over HTTP, giving an attacker on the network a window to intercept or downgrade the connection before any redirect happens.
Why it matters
A single HTTP request is enough for a man-in-the-middle attacker on a shared network, public Wi-Fi, a compromised router, to strip encryption, read cookies, or serve a fake login page. HSTS closes that window at the browser level, before your server ever gets a chance to redirect.
Domain Flock flags this header as missing because it is one of the highest-impact, lowest-effort headers to add: most web servers and CDNs support it with a single config line.
Recommended value
max-age: how long (in seconds) the browser should enforce HTTPS-only. Two years (63072000) is the widely recommended value.includeSubDomains: applies the policy to every subdomain, not just the exact host that sent the header.preload: opts you into browser vendors' HSTS preload lists, so even a user's very first visit is HTTPS-only. Submitting to the preload list is a separate, largely irreversible step: read the requirements before adding it.
Rollout tips
Only send this header once you are confident every subdomain in scope actually serves valid HTTPS: the policy is cached client-side for the full max-age, so a misconfigured subdomain can become unreachable for anyone who already received the header. Start with a shorter max-age while testing, then raise it once you're confident.