Netsparker identified that the target website allows web browsers to access to the website over HTTP and doesn't redirect them to HTTPS.
HSTS is implemented in the target website however HTTP requests are not redirected to HTTPS. This decreases the value of HSTS implementation significantly.
For example visitors who haven't visited the HTTPS version of the website previously will not be able to take advantage of HSTS.
Users will not be able to take advantage of HSTS which almost renders the HSTS implementation useless. Not having HSTS will make MITM attacks easier for attackers.
Configure your webserver to redirect HTTP requests to HTTPS.
For Apache, you should have modification in the httpd.conf.