What is HSTS (HTTP Strict Transport Security)?

HSTS is a response header that tells browsers to connect to a site only over HTTPS for a set period, blocking downgrade attacks on the first insecure request.

A typical value is max-age=63072000; includeSubDomains; preload — two years, covering every subdomain. Once a browser has seen the header it rewrites any http:// link to https:// before sending a request.

Domains on the browser HSTS preload list are protected even on a visitor's very first visit. Preloading is hard to undo, so every subdomain must support HTTPS first.