J
Jenna Algire
  1. Turn on the HSTS security header (Strict-Transport-Security). This header tells web browsers to always load a site over a secure, encrypted connection, even when a visitor types the address without "https." Without it, a visitor's first visit can briefly start on an unencrypted connection before the site switches them to the secure version.
  2. Update the order of the secure redirect. When a visitor types a website address without "www" and without "https," the site should switch to the secure version first and add "www" after that, rather than doing both in one step. Browsers need this order to fully apply the security header above.
Why it matters: Financial professionals are increasingly asked about website security in compliance reviews, vendor due-diligence questionnaires and outside security scans. A missing HSTS header is one of the most common items these scans flag. FMG manages the hosting, so this can only be turned on at the platform level, and individual advisors have no way to add it themselves.
Thank you for considering this improvement.