HSTS
acronymsecurityweb dev
Stands for: HTTP Strict Transport Security
A header that forces browsers to use HTTPS for a site.
HTTP Strict Transport Security (RFC 6797) tells a browser to only ever connect to a site over HTTPS, refusing plaintext and blocking click-through on certificate warnings. It defends against downgrade and stripping attacks.
HSTS closes a gap that HTTPS alone leaves open. A user typing a bare hostname makes an initial plaintext request, and an attacker positioned on the path can intercept that first request and keep the entire session on HTTP, stripping the upgrade before it happens. The redirect to HTTPS is only as trustworthy as the request that received it.
The header tells the browser to refuse plaintext for this host for a stated period, so subsequent visits go straight to HTTPS with no interceptable first request. Preloading closes the remaining hole by shipping the policy inside the browser itself, which means even the very first visit is protected.
The commitment is the part to think about before deploying. A long max-age is a promise browsers will keep even if you later want to serve something over HTTP, and includeSubDomains extends that promise to hosts you may not have inventoried. Preload removal is slow, measured in browser release cycles. Deploy with a short duration first, confirm every subdomain genuinely serves HTTPS, then raise it, because the failure mode is your own site becoming unreachable with no quick undo.
Also known as: hsts