greetings, thank you for the quick response, greatly appreciated!
i followed your suggestions and while at first i was still seeing the odd number you pointed out, i ran it against some client sites also using your plugin and they call came back as you pointed out, so it was definitely something about this particular client, even though they are all even using the same web host.
somewhere an old plugin or something must have been overriding your plugin settings, i turned off some other ‘security’ plugins that seemed to have some overlap, xframe options and the like and voila, i no longer get that error!
https://hstspreload.org/?domain=penchecks.com and can see the subdomain, correct max age etc.
thank you for pointing me in the right direction!
