No HSTS header

Redirecting http:// to https:// leaves one unprotected request: the first one, before the redirect. On a shared network that request can be intercepted and answered with a copy of your site, and the visitor never reaches the redirect at all.

Strict-Transport-Security closes it. The browser remembers, for as long as max-age says, that this host is https only, and rewrites the address itself before anything is sent. It costs one response header.

A notice, not a warning, because it is a second lock on a door that is already locked: the site is served over https and does redirect, or security.https would be saying so instead. It is also the one header here with a way to hurt: a browser that has been told to remember your host will refuse to load it over http for the whole of `max-age`, so a site not yet certain it can serve https everywhere should start with a short one.

Source: MDN: Strict-Transport-Security; OWASP's HSTS cheat sheet.

Send the header on https responses. Six months, once you are sure every subdomain can serve https:

Strict-Transport-Security: max-age=15552000; includeSubDomains

Start at max-age=300 for a day or two and watch for anything of yours still on http — an old blog on a subdomain is the usual casualty — then raise it. Only add preload when you mean it: getting a domain off the browsers' preload list takes months.