HSTS

HSTS (HTTP Strict Transport Security) declares via an HTTP header that a site is reachable only over HTTPS, preventing SSL stripping and downgrade attacks.

Purpose

It forces browsers to always use HTTPS for the site, even when the user types HTTP.

Mechanism

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Once the browser records it, every HTTP request is automatically upgraded to HTTPS for the max-age period. The preload directive qualifies the site for the browser's built-in HSTS Preload List.

Use cases

SSL stripping defense
Enforced HTTPS upgrades
Subdomain protection
The preload list

Examples

Input

max-age=31536000; preload

Output

HTTPS enforced for one year

With preload

Common errors

Without HSTS, the first HTTP visit is exposed to man-in-the-middle attackers: Set HSTS and join the preload list

Related terms

TLS (Transport Layer Security) provides encryption, integrity, and authentication at the transport layer; it replaced SSL and underpins HTTPS, SMTPS, and more.

HTTPS is HTTP over TLS: it encrypts HTTP communication at the transport layer, providing confidentiality, integrity, and server authentication, and it is the modern web standard.

Security Header

Security HTTP headers are response headers instructing the browser to enable security mechanisms, such as CSP, HSTS, and X-Frame-Options.

References