Why it matters
Without this setting (HSTS), someone on the same Wi-Fi can quietly downgrade a visitor to the insecure version of your site. One header closes that door.
How to check it yourself
Open DevTools, go to the Network tab, reload, click the first request and look under Response Headers for strict-transport-security. If it isn't there, it's missing.
What the fix involves
Send the header Strict-Transport-Security with a max-age of at least six months from your framework's or host's headers config. Make sure the whole site works on HTTPS first, because browsers will remember the instruction.
Reference: developer.mozilla.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.