HSTS - HTTP Strict Transport Security
Learn how HSTS forces HTTPS connections. Understand preload lists and common HSTS configuration pitfalls.
What is HSTS?
HTTP Strict Transport Security (HSTS) is a security header that tells browsers to always use HTTPS for your domain. Once enabled, browsers will never attempt an HTTP connection - eliminating the vulnerable redirect that attackers can exploit.
The SSL Stripping Problem
Without HSTS, there's a dangerous moment when you first visit a site:
example.comThat initial HTTP request can be intercepted on public WiFi! An attacker can serve a fake HTTP version of the site and steal your credentials. This is called an SSL stripping attack.
How HSTS Fixes This
Browser converts http:// to https:// internally
Policy remembered for months/years
Optional includeSubDomains directive
Hardcoded in browsers for zero first-visit risk