Why it happens
Nothing tells browsers to stay on HTTPS. A visitor who types the address without https, or follows an old link, can be served over plain HTTP and downgraded on the way.
How to tell
- The free check: header missing.
- http:// answers with content instead of redirecting.
The fix
- Send Strict-Transport-Security: max-age=31536000; includeSubDomains on every response, from the framework's headers configuration or the host's settings.
- Redirect http to https at the host.
- Add preload only once every subdomain serves HTTPS; it is hard to undo.
The prompt for your builder
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever built the app. Replace anything in capitals. It never asks you to paste a secret into a chat; keys go into your host’s environment, by you.
Prompt for your builder
Add security headers to every response my app sends: Strict-Transport-Security with a one-year max-age and includeSubDomains, X-Content-Type-Options set to nosniff, and a Content-Security-Policy frame-ancestors directive that allows only my own origin (plus X-Frame-Options SAMEORIGIN for older browsers). Show me the change in my framework's configuration file, and tell me which of these my host can set instead.
How Keelnest catches it
Every five-minute check reads the security headers. A missing one is Degraded — shown on your screens, never sent to anybody's inbox.
Know the moment this happens.
Keelnest watches your production app every five minutes and tells you in plain English what broke — with the fix. Free for your first app.