HSTS

Definitions

1. HTTP Strict Transport Security — a security header that tells browsers to only communicate with the server over HTTPS, refusing all HTTP connections. Once a browser sees an HSTS header, it will automatically upgrade any HTTP request to HTTPS for the specified duration, preventing SSL stripping attacks. Getting on the browser's preload list makes this protection permanent.

   In plain English: A security setting that forces browsers to always use encrypted connections to your website — once set, even typing 'http://' gets automatically upgraded to 'https://'.

   Example: After enabling HSTS with a one-year max-age and adding the domain to Chrome's preload list, SSL stripping attacks became impossible against our users.

Related Terms

• OWASP
• CORS
• CSP
• subresource integrity
• HSTS
• Deep Web