SC-01. Public security configuration
- Observed
- The tested HTTPS page has no observed HSTS header.
- Evidence
- Fictional capture SC-01. No real website tested.
- Customer impact
- The response does not announce a browser HTTPS-only policy.
- Recommended fix
- Assess the HTTPS deployment and introduce an appropriate HSTS policy after testing.
- Priority
- Low