https://shipreadyai.dev/learn/findings/o2-hsts-missing

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Strict-Transport-Security is not set

A browser that has been to the site before can still be pushed to the plain http version on a hostile network.

## Why AI-built apps get this

Response headers are written by nobody. Your framework does not add them, your builder does not add them, and your host adds one or two at most. They are the clearest example of a gap that no tool closes on your behalf, which is why almost every app built by a prompt ships without them.

## Evidence line

GET https://example.com returned no strict-transport-security header

## The fix

Add a Strict-Transport-Security response header, for example max-age=31536000; includeSubDomains, in your hosting header settings.

## Prompt

Set the Strict-Transport-Security response header to max-age=31536000; includeSubDomains on every HTML response. It tells browsers to keep using https after the first visit, so a visitor on public wifi never falls back to a plain connection. Add it wherever this app sets response headers: the server framework, a middleware, or the hosting platform's headers configuration. Verify by requesting the page with curl -I.