HTTPS is enforced

Without HTTPS enforcement, every byte transmitted between your server and the user travels in plaintext — session tokens, form fields, and API responses are readable by anyone on the same network. Man-in-the-middle attackers on public Wi-Fi can silently rewrite page content, inject scripts, or steal credentials before the user even knows they're on your site. PCI-DSS 4.0 Req 4.2.1 and NIST SP 800-53 SC-8 both mandate encrypted transport; a lapse here puts cardholder data directly in scope for a breach. OWASP A02 (Cryptographic Failures) flags unencrypted transport as the most straightforward path to data exposure.

Add an explicit HSTS header via your framework config so browsers and intermediaries refuse to downgrade connections. Most modern hosts (Vercel, Netlify, Cloudflare Pages) enforce HTTPS automatically, but the header is still required for browser-side enforcement.

// next.config.js
async headers() {
  return [{
    source: '/(.*)',
    headers: [{
      key: 'Strict-Transport-Security',
      value: 'max-age=31536000; includeSubDomains'
    }]
  }]
}

For Express or Fastify, helmet() sets HSTS and a sensible default for every other security header in one call.