Missing or weak Strict-Transport-Security
Effort to fix: Quick win (under an hour)
Why it matters
HSTS tells browsers to always use HTTPS for your domain, closing the window where a first plain-HTTP request can be hijacked.
How to fix it
Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses. Start with a short max-age if unsure, then raise it; only add preload once every subdomain supports HTTPS.
On WordPress
Set the header at the server/CDN (Apache Header always set ..., Nginx add_header ... always) or via your host's security headers setting.