I think I explained myself badly. Im entering sites INTO https://web.dev that we make at work. Web.dev is basically Google Lighthouse and tests your website for basic performance, seo, best practices and A11Y.

So for example I enter mycustomer.com and it tells me "avoid http redirects" because I didn't enter the https:// before.

Hsts is included in one of our packages which also includes CSP settings and other security stuff, but barely anyone buys that.