mediumConfirmedfailSecurity headers
Missing Strict-Transport-Security (HSTS)
Without HSTS, a first visit over an untrusted network can be downgraded to HTTP.
Confirmed from the HTTP response headers of the main document.
Locations
- https://grafista.io/
Copy-paste fix prompt
Security fix for this v0 / Next.js app. Add the header `Strict-Transport-Security: max-age=31536000; includeSubDomains` to every HTTPS response (in Next.js via `headers()` in next.config, on Vercel via vercel.json, on Netlify via _headers). Use route handlers or server actions for privileged work, keep secrets in non-NEXT_PUBLIC_ env vars behind `import "server-only"`, and set headers in next.config.