No Strict-Transport-Security
WarningLow priority
Secure pages of this site whose response does not send a Strict-Transport-Security header.
Why it matters
Without it a browser will still try the http address first when someone types it, and that first request can be intercepted before any redirect to https happens.
How to fix it
Send Strict-Transport-Security with a max-age of at least a year from every https response, once the whole site works over https.
Skitter runs this check on every crawl, and lists each page it finds with the evidence: the header, the tag or the link that gave it away.