HSTS checker
HSTS tells a browser to refuse plain HTTP for a site from now on, which closes the gap where a visitor typing the address without "https" can be intercepted on that first request. It is one header, and it is either configured properly or it is barely doing anything.
Check the whole site while you're here
Nineteen checks across performance, findability, security, accessibility and AI readiness. Under a minute, no account.