When convenient

Your site lets browsers fall back to an insecure connection

This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.

What we saw

A setting called HSTS is missing. It tells browsers to always use the secure, padlocked connection to your site.

Why it matters

Without it, someone on the same Wi-Fi as a visitor can quietly downgrade the connection and read or change what they see.

How to fix it

Send the technical line below to whoever runs your site. Each of these is a one-line change in the server or hosting settings, and none of them changes how the site looks.

For your developer