# What Is HSTS (HTTP Strict Transport Security)?

> HSTS is an HTTP response header that tells browsers to reach a site only over HTTPS for a set period and to refuse to bypass certificate errors there.

Source: https://ssl.sh/glossary/hsts/
Last updated: 2026-11-10

HTTP Strict Transport Security is defined in [RFC 6797](https://www.rfc-editor.org/rfc/rfc6797). When a browser receives the `Strict-Transport-Security` header over a valid HTTPS connection, it records the host as an HSTS host for `max-age` seconds. During that time it rewrites every `http://` URL for that host to `https://` before sending anything, and treats certificate errors as fatal, with no option to proceed anyway. The header is ignored when it arrives over plain HTTP.

## Why it matters
A server-side redirect from HTTP to HTTPS still leaves the first plaintext request exposed, which is exactly what [SSL stripping](https://ssl.sh/glossary/ssl-stripping/) exploits. HSTS removes that request on every visit after the first, and turns a man-in-the-middle with an invalid certificate into a hard failure instead of a warning users click through. The `includeSubDomains` directive extends the policy to every subdomain, which is powerful but breaks any subdomain that still serves only HTTP. To protect the very first visit, the domain has to be on the [HSTS preload](https://ssl.sh/glossary/hsts-preload/) list.

## Example
```nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
```

```bash
curl -sI https://example.com | grep -i strict-transport-security
```

Start with a short `max-age` such as 300 while you confirm every subdomain works over HTTPS, then raise it. In Chrome DevTools an HSTS upgrade shows up as a 307 Internal Redirect that never reaches the network.

## Common misconceptions
- **HSTS protects the very first visit.** Without preloading, the browser has not seen the header yet, so the first request can still be intercepted.
- **Sending the header on the HTTP response is enough.** Browsers ignore it over HTTP; it must arrive over HTTPS with a valid certificate.
- **HSTS pins certificates like HPKP did.** HSTS only forces HTTPS and does not care which certificate you use. [HPKP](https://ssl.sh/glossary/hpkp/), which did pin keys, was removed from Chrome in Chrome 72.

## Related terms

- [HSTS 预加载](https://ssl.sh/zh/glossary/hsts-preload/): HSTS 预加载是内置在浏览器中的一份域名列表，列表内的域名始终通过 HTTPS 访问，连首次访问、尚未收到 HSTS 头之前也受保护。
- [SSL 剥离](https://ssl.sh/zh/glossary/ssl-stripping/): SSL 剥离是一种中间人攻击，攻击者截获本应把用户引向 HTTPS 的跳转或链接，让用户一直停留在明文 HTTP 上。
- [HTTPS](https://ssl.sh/zh/glossary/https/): HTTPS 是在 TLS 加密连接之上传输的 HTTP，默认使用 443 端口，使网页内容、Cookie 和表单数据被加密，并验证服务器身份。
- [混合内容](https://ssl.sh/zh/glossary/mixed-content/): 混合内容是指通过 HTTPS 加载的页面中，部分脚本、图片、iframe 等子资源仍通过明文 HTTP 加载，削弱了整个页面的安全性。
- [中间人攻击](https://ssl.sh/zh/glossary/man-in-the-middle/): 中间人攻击是指攻击者暗中插入通信双方之间，转发并可能篡改流量，而双方都以为自己在直接和对方通信。
- [HPKP](https://ssl.sh/zh/glossary/hpkp/): HPKP 是 RFC 7469 定义、现已废弃的 HTTP 响应头，要求浏览器只在证书链包含指定公钥时才接受该网站。