HSTS set but not on the browser preload list

HSTS (HTTP Strict Transport Security) is a header that tells a visitor's browser to always use a secure HTTPS connection to your site from now on. The 'preload' list is built into browsers themselves and enforces this from a visitor's very first visit, before the site has sent them any headers at all. This check looks for whether the site is configured for preload and actually on that list. On this site, HSTS is present, but it lacks the preload directive and isn't on the list. Without preload, a visitor's very first visit to the site is always unprotected, since the browser has no way to know in advance that it should require HTTPS before it's received any response at all from the server. That first-visit gap remains exploitable for man-in-the-middle and downgrade attacks, even though every visit after the first one is protected once the HSTS header has been seen once. Your developer should add the 'preload' directive to the HSTS header, keep max-age at 31536000, one year, then submit the domain at hstspreload.org, the official browser preload submission site. This takes about 10 minutes of configuration, but propagation to actually appear on browsers' built-in lists takes one to two weeks after submission.