missing_hsts
HSTS missing from an HTTPS response
AuditLume examines one public response and its initial HTML. It does not perform a complete site audit.
Indicative impact: 8/100 · security
What it detects
When the final URL uses HTTPS, finds no Strict-Transport-Security response header.
AuditLume examines one public response and its initial HTML. It does not perform a complete site audit.
Why it may matter
The signal helps prioritise a review because it may affect understanding, privacy, accessibility or technical protection. Its impact is indicative and must be interpreted in the page’s real context.
How to verify manually
Open the final URL and inspect the initial HTML and response headers with browser developer tools or curl. Repeat the check on representative templates and routes before drawing a conclusion.
When the final URL uses HTTPS, finds no Strict-Transport-Security response header.
Cautious correction
Verify HTTPS across affected subdomains first; deploy HSTS gradually with a cautious duration.
What it does NOT prove
This signal alone does not certify legal compliance or non-compliance, GDPR, WCAG or EAA; it is not a human or professional security audit and does not prove the presence or absence of all risk.