HTTP Strict Transport Security (HSTS)

Overview

HTTP Strict Transport Security lets a website instruct compatible user agents to access it only through secure transport for a specified period. The policy is delivered through the Strict-Transport-Security response header received over a valid HTTPS connection.

HSTS helps prevent protocol downgrade and cookie exposure caused by accidental or attacker-forced HTTP access. The includeSubDomains directive extends coverage, while browser preload lists can protect the first visit when a domain meets program requirements.

Operators should deploy HTTPS correctly across covered hosts, choose policy duration carefully, and test subdomains before enabling broad directives or preload. HSTS does not repair invalid certificates, application vulnerabilities, compromised endpoints, or mixed trust in external services.

For HTTP Strict Transport Security (HSTS), production scope should name the relevant endpoints, objects, workloads, secrets, dependencies, and tenant boundaries, the decision being supported, the accountable owner, and the time and jurisdiction boundaries.

For HTTP Strict Transport Security (HSTS), repeated renewal is a signal that the underlying design needs correction.

HSTS is a browser-enforced web security policy that requires future connections to a declared host to use HTTPS instead of insecure HTTP. HSTS removes insecure HTTP fallback after policy establishment, but safe deployment requires complete HTTPS coverage and careful subdomain planning.

A production treatment of HTTP Strict Transport Security (HSTS) should test the requirement for future connections to a declared host to use HTTPS instead of insecure HTTP within the relevant asset, decision, or service state. The HTTP Strict Transport context record for future connections to a declared host should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of HTTP Strict Transport Security (HSTS) should determine whether safeguards addressing future connections to a declared host changed exposure in practice, not merely whether a document or setting existed.