juniorWeb Security
What is HTTP Strict Transport Security (HSTS)?
Updated May 6, 2026
Short answer
HSTS forces browsers to always use HTTPS for a website.
Deep explanation
HSTS is a security header that prevents protocol downgrade attacks by instructing browsers to only communicate over HTTPS for a defined period.
Real-world example
Banks enforce HSTS to prevent users from accidentally using HTTP.
Common mistakes
- Not enabling HSTS on all subdomains.
Follow-up questions
- What is HSTS preload list?
- Can HSTS be reversed?