Steps to reproduce it: `docker run -it --rm shcheck "https://www.google.com/"` It shows that Strict-Transport-Security is missing, but if you check in your browser it is there. Current result: 