StrictTransportSecurity

Strict-Transport-Security (HSTS) is an HTTP security header that allows a website to declare that it should only be accessed over HTTPS. When a user agent receives this header, it will thereafter attempt to load the site exclusively over secure connections for the period defined by max-age.

The header value must include max-age, the number of seconds the policy should be enforced. Optional directives include includeSubDomains, which applies the rule to all subdomains, and preload, a signal to browsers that the site intends to be included in the browser’s HSTS preload list (not standardized by RFC 6797, but widely recognized by major browsers).

Deployment involves configuring the server to issue the header on HTTPS responses and redirecting all HTTP requests to HTTPS. If a site plans to use the preload list, it should submit to the list and ensure max-age is at least 31536000 seconds (one year). Once a client caches the policy, it cannot be easily undone; to disable enforcement, the site must send max-age=0.

Impact and limitations: HSTS protects against protocol downgrade attacks and cookie hijacking by enforcing HTTPS, but it does not provide TLS itself or shield against all other threats. Enabling includeSubDomains means every subdomain must support HTTPS, so misconfigurations can render some services inaccessible. After enabling, changes can take effect slowly due to client-side caching.

Browser support and scope: Most major browsers support HSTS, and preload is supported by major engines. HSTS applies only to user agents that honor the header and does not affect non-browser clients or intermediaries that do not recognize the policy.