HSTS (HTTP Strict Transport Security)

HTTP Strict Transport Security is a browser-enforced policy sent in the `Strict-Transport-Security` response header over a valid HTTPS connection. It tells a supporting user agent to use HTTPS for that host for the period set by `max-age`, upgrading later HTTP URLs before sending a request and treating certificate errors as fatal. The optional `includeSubDomains` directive extends the policy to subdomains. TLS provides the encryption; HSTS governs how the browser connects.

Why it matters: Complete the HTTPS migration before enabling a long-lived HSTS policy: every covered host must have a valid certificate and remain available over HTTPS. Send the header on HTTPS responses, keep an HTTP-to-HTTPS redirect for clients without a stored policy, begin with a short `max-age`, monitor for failures, and lengthen it deliberately. Add `includeSubDomains` only after auditing current and future subdomains. Browser preload lists can protect the first connection by shipping the policy in advance, but preloading is a separate, consequential commitment with stricter requirements and slow removal; do not add the `preload` directive casually. Without preload or a previously stored policy, an initial HTTP visit remains exposed. HSTS does not correct certificate, TLS-configuration, mixed-content, application-security, or unsupported-client problems.