If your website uses HTTPS (the padlock in the address bar), the connection between the visitor and your server is encrypted. But there is a gap in that system: the very first time someone visits your site, that request sometimes still goes over HTTP (no padlock). Only then does your server redirect them to HTTPS.
In that brief moment between HTTP and HTTPS, someone on a public Wi-Fi network, for example, could in theory hijack the connection. It is rare, but it happens.
What does HSTS fix?
HSTS (Strict-Transport-Security) is an instruction your server gives to browsers: "from now on, every connection to me is encrypted, even the first one." The browser remembers this and goes straight to HTTPS, with no stop in between.
Do you need to do anything?
Yes, but it is a one-off job for your web developer. They need to set a header on your server. It takes 5 minutes, but you cannot do it yourself without technical knowledge. If you have a WordPress site with a good hosting provider, this is usually already set up or can be handled with a plugin.
What difference does it make to your Google rankings?
Not much directly. Google sees HSTS as a small trust signal, but it is not a major ranking factor. It is more of a hygiene item: present = professional, missing = there is still a small thing that has not been set up. Think of it as the spell check of your website.