The site uses SSL and the Strict-Transport-Security HTTP header is not defined

Nikto output

The site uses SSL and the Strict-Transport-Security HTTP header is not defined

Description

HTTP Strict Transport Security (HSTS) is an opt-in security enhancement that is specified by a web application through the use of a special response header.
Once a supported browser receives this header that browser will prevent any communications from being sent over HTTP to the specified domain and will instead send all communications over HTTPS. It also prevents HTTPS click through prompts on browsers

Solution

Set the Strict-Transport-Security: max-age=31536000; includeSubDomains

For IIS:
Install HTTP Strict Transport Security IIS Module.
http://hstsiis.codeplex.com/

References