HSTS (HTTP Strict Transport Security)

HSTS (HTTP Strict Transport Security) is a security policy delivered through an HTTP header that instructs a browser to communicate with a given domain exclusively over the encrypted HTTPS protocol. Once received, the browser automatically upgrades every http:// request to https:// before it is ever sent, eliminating the risk of an intercepted plaintext connection. The standard is defined in RFC 6797.

How HSTS works

The server sends a Strict-Transport-Security header in its HTTPS responses. The browser remembers the policy for the duration set by the max-age directive (in seconds) and, throughout that period, refuses any plain HTTP connection to the domain. The key directives are:

• max-age — how long the policy stays in effect, typically one year (31536000 seconds).
• includeSubDomains — extends the policy to all subdomains.
• preload — submits the domain to the list hard-coded into browsers.

HSTS specifically neutralizes the SSL stripping attack, in which a man-in-the-middle attacker rewrites secure links to HTTP versions. Because a browser holding the policy never even attempts an unencrypted connection, such a downgrade becomes impossible.

Practical application

HSTS is standard in banking, admin panels and online stores, where protecting the session is critical. It is deployed by adding the header in the web server configuration (Apache, Nginx) or in an .htaccess file. The recommended sequence: first confirm that the entire site, including subdomains, works correctly over HTTPS with a valid TLS certificate, then set a short max-age and gradually increase it, and only at the end consider submitting to the preload list. HSTS is usually rolled out alongside other security headers such as CSP and X-Frame-Options.