What it is
Without HSTS, the first request to a site can still go over insecure HTTP before redirecting. The Strict-Transport-Security header tells browsers to always use HTTPS from the start. No Strict-Transport-Security header. Minor; leaves a window for downgrade on first visit.
Why does hsts header missing matter for AI search?
Minor; leaves a window for downgrade on first visit.
How do you fix it?
Add HSTS once HTTPS is stable.
How do you find it on your site?
- Check response headers for Strict-Transport-Security with curl -I.
- Confirm HTTPS is fully working before enabling it.
- Add the HSTS header with a sensible max-age.
- Consider preloading once you are confident it is permanent.
Which ranking and citation factors does it touch?
HSTS is a security hardening measure with little direct ranking effect, but it closes a small insecure-first-request gap.
What is the impact?
Low. Inferred (security best practice).
What is the evidence?
HSTS strengthens HTTPS enforcement. Google Search Central, Secure your site with HTTPS
Frequently asked questions about hsts header missing
What does "HSTS header missing" mean?
No Strict-Transport-Security header.
How do you fix hSTS header missing?
Add HSTS once HTTPS is stable.