What is HSTS?

Also called Strict-Transport-Security, HTTP Strict Transport Security.

HSTS is a header that tells a browser to only ever reach your site over HTTPS, even if a link says http. Once the browser has seen it, it upgrades the connection itself rather than making the insecure request first.

In more detail

Without it, the first request of a visit can go out over plain HTTP before your redirect answers — and that request is the one an attacker on the same network can intercept. HSTS closes that gap for every visit after the first. The header carries a max-age telling the browser how long to remember, typically a year.

Why it matters for your site

It matters most on shared networks — cafés, hotels, airports — where intercepting a single unencrypted request is genuinely easy. Start with a short max-age: while HSTS is active, a browser will refuse to reach your site over HTTP at all, so a broken certificate becomes a hard outage rather than a warning.