HSTS
also: HTTP Strict-Transport-Security, Strict-Transport-Security header
HTTP Strict-Transport-Security (HSTS) is a security mechanism that forces web browsers to communicate with a server exclusively over encrypted HTTPS connections, preventing downgrade attacks.
HSTS is implemented through an HTTP response header that instructs browsers to automatically upgrade all future connections to a domain from HTTP to HTTPS, even if the user types http:// in the address bar.
When a server sends the Strict-Transport-Security header (e.g., Strict-Transport-Security: max-age=31536000; includeSubDomains), the browser remembers this policy for the specified duration and enforces it locally. This protects against man-in-the-middle attacks where an attacker might intercept an unencrypted HTTP request.
HSTS is particularly valuable because it prevents the initial unencrypted connection—even before HTTPS redirection occurs. Major browsers also maintain preload lists of domains that should always use HTTPS, providing protection even on first visit.