HSTS: Force HTTPS and Eliminate SSL Stripping

What is HSTS?

HTTP Strict Transport Security (HSTS) is an HTTP response header that instructs browsers to only access a website using HTTPS, never HTTP. Once a browser receives an HSTS header, it will automatically convert any HTTP URLs to HTTPS before making requests.

This simple header provides powerful protection against man-in-the-middle attacks, specifically the "SSL stripping" attack that exploits the initial HTTP request before redirect.

The SSL Stripping Problem

When you type example.com into your browser (without https://), the browser first tries HTTP. The server then redirects you to HTTPS. This creates a vulnerability window:

This attack is called SSL stripping because the attacker "strips" the SSL/TLS layer, keeping you on unencrypted HTTP while proxying your requests.

How HSTS Works

HSTS solves the SSL stripping problem by telling browsers to never make HTTP requests:

HSTS Header Directives

The Preload List

Even with HSTS, there's still a vulnerability on the very first visit before the browser receives the HSTS header. The HSTS preload list solves this by hardcoding HSTS-enabled domains directly into browsers.

Implementation Guide

Apache (.htaccess or httpd.conf)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

IIS (web.config)

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="Strict-Transport-Security" 
           value="max-age=31536000; includeSubDomains; preload" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

Express.js (Node.js)

app.use((req, res, next) => {
  res.setHeader('Strict-Transport-Security', 
    'max-age=31536000; includeSubDomains; preload');
  next();
});

Common Mistakes

Testing HSTS

Using curl

curl -I https://example.com | grep -i strict-transport-security

Browser DevTools

Open DevTools → Network tab → Reload → Click main request → Headers tab → Look forStrict-Transport-Security

Check Preload Status

Visit hstspreload.org and enter your domain to check eligibility and current status.

Frequently Asked Questions