Skip to main content
protocols.pageprotocols.page
security

HSTS (HTTP Strict Transport Security)

HSTS is an HTTP response header that instructs browsers to only connect via HTTPS for a specified duration. Once set, the browser refuses HTTP connections to that domain – even if the user types http://. HSTS prevents SSL-stripping MITM attacks. The preload list hardcodes HSTS into browsers, protecting even the first visit.

Definition

HTTP Strict Transport Security (RFC 6797) eliminates the window of vulnerability between a user typing a URL and the server redirecting to HTTPS. The server sends Strict-Transport-Security: max-age=31536000; includeSubDomains; preload in its HTTPS response. The browser records this and for the next year, automatically converts any http:// request for that domain to https:// before sending it. This defeats SSL-stripping attacks (Moxie Marlinspike's sslstrip) where an attacker intercepts the initial HTTP request and proxies the connection without TLS. The preload directive signals willingness to be included in browser HSTS preload lists – Chrome, Firefox, Safari, and Edge ship with ~200,000 preloaded domains that are HTTPS-only from first visit. Submission: hstspreload.org. Warning: preload is effectively permanent – removal takes months.

Examples

  • –Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  • –curl -sI https://example.com | grep -i strict
  • –hstspreload.org to submit domain for browser preload lists

Related Protocols

httptls

Related Terms

TLS Termination

TLS termination is the practice of decrypting TLS traffic at a load balancer or reverse proxy rather than at the application server. The proxy handles certificate management, cipher negotiation, and CPU-intensive cryptographic operations. Backend traffic between proxy and application runs over HTTP (or re-encrypted with a simpler internal cert).

Man-in-the-Middle (MITM)

A man-in-the-middle attack intercepts communication between two parties, reading or modifying traffic without either party's knowledge. TLS prevents MITM by authenticating the server via certificates and encrypting the channel. MITM succeeds when: TLS is absent (HTTP), certificate validation is disabled, or the attacker controls a trusted CA.