Glossary
HSTS
HTTP Strict Transport Security is a response header that tells browsers to contact a site only over HTTPS for a stated period.
Updated 2 Sept 2026
In detail
HSTS closes the gap that exists before a redirect can run: without it, the first request to http:// travels in cleartext and can be intercepted or downgraded. Once a browser has seen the header it rewrites subsequent requests to HTTPS itself and refuses to let users click through certificate warnings for that host.
Why it matters
An HTTP-to-HTTPS redirect alone still leaves the initial request interceptable, which is enough for a network attacker to strip TLS or steal a session cookie. HSTS removes that window for returning visitors, and preloading removes it for first-time visitors too.
Examples
- Strict-Transport-Security: max-age=31536000 — a one-year policy for the host.
- Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — the configuration required for preload-list submission.