Simple definition
HSTS (HTTP Strict Transport Security) tells a browser that a website must be contacted only over HTTPS for a defined period.
Technical definition
The server sends the Strict-Transport-Security HTTP header over an HTTPS connection with a max-age directive and optionally includeSubDomains. The preload mechanism relies on a browser-maintained list and has additional requirements.
How it works / role
After storing the HSTS policy, the browser upgrades future HTTP attempts to HTTPS before sending the request. While HSTS is active, certificate errors cannot be bypassed in the same way as on an ordinary HTTPS visit. A policy using includeSubDomains also applies to the covered subdomains.
What is it used for?
Reduce downgrade-to-HTTP risks and interception during an HTTP-to-HTTPS redirect after the policy has been learned, or from the first visit when the domain is preloaded.
Practical example
A user enters http://example.com. If the browser already knows the domain’s HSTS policy, it opens https://example.com directly without sending an HTTP request first.
Common issues
- Certificate has expired or is invalid after HSTS is enabled
includeSubDomainsis enabled while a subdomain is not HTTPS-readymax-ageis too long during a migration- The domain is submitted for preload before the architecture is ready
Related terms
Key takeaway: HSTS is enforced by the browser; deploy it progressively and only when HTTPS and certificate management are reliable across the intended scope.