HSTS is a security mechanism defined in RFC 6797 that forces browsers to use HTTPS for all future connections to a domain, preventing downgrade attacks and man-in-the-middle vulnerabilities.
When a server responds with the Strict-Transport-Security header, the browser caches the policy for the duration specified in the max-age directive (in seconds). Any subsequent attempt to access that domain over HTTP is automatically upgraded to HTTPS, even if a user types http:// in the address bar or clicks an insecure link.
Header example:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
The directive includeSubDomains extends the policy to all subdomains, and preload allows the domain to be included in browser preload lists—shipped baked into Chrome, Firefox, Safari, and Edge—so HTTPS is enforced even on a user's very first visit, before the header is ever received.
Preload requirements: If using preload, max-age must be at least 31536000 (1 year) and includeSubDomains must be present. Domains must also be manually submitted to the HSTS preload list for vetting.
WarningWithout preload submission, HSTS only protects users after they've first visited your site over HTTPS. On that initial visit, they remain vulnerable to downgrade attacks unless your server redirects all HTTP traffic to HTTPS before sending the header.
HSTS is essential for high-security applications and is commonly paired with SSL certificates to lock browsers into secure-only connections.