What it is

Your site doesn't tell browsers to always use a secure (HTTPS) connection. Without this header, a visitor who types the plain http:// address, or clicks an old http:// link, can be sent over an insecure connection first, which an attacker on the same network could intercept.

How to fix it

Add the Strict-Transport-Security (HSTS) header at your server or CDN so browsers always upgrade to HTTPS on this domain. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

Your website isn't telling visitors' browsers to always use the secure HTTPS connection, which means someone could potentially access your site over an unprotected connection if they type in the address without the "s" in "https" or follow an old link that lacks it. When data travels over an unprotected connection, someone on the same network as your visitor, like at a coffee shop, could theoretically intercept sensitive information like passwords or credit card numbers. This protection is especially important because many visitors don't think about whether they're on a secure connection. To fix this, you need to add what's called an HSTS header to your server, which is a simple instruction that tells all browsers "always use HTTPS for this website, no exceptions." If you're using a hosting company like Bluehost, SiteGround, or WP Engine, you can often enable this in their control panel under security settings, or ask their support team to turn it on for you. If you're less technical, installing a WordPress security plugin like Wordfence or All In One WP Security & Firewall can add this protection automatically without you having to touch any code.