HTTP Strict Transport Security (HSTS)

HTTP Strict Transport Security (HSTS) is a web security policy that tells browsers to use HTTPS for a host.

Format
Security & Encryption
Updated
Updated
Glossary Security & Encryption
HTTP Strict Transport Security Also known as HSTS.Aliases: Strict-Transport-Security.

Definition

HTTP Strict Transport Security (HSTS) is a web security policy that tells browsers to use HTTPS for a host.

How it works

Your site sends the Strict-Transport-Security header over HTTPS, and the browser remembers: for the stated period, never contact this host over plain HTTP. From then on, the browser upgrades insecure requests itself before they leave the machine. Turn it on only once your HTTPS setup and redirects are solid — the browser will hold you to the policy for the entire duration you declared.

Example: A browser with an active HSTS policy rewrites an http:// request for the host to https:// before sending it.

Often confused: HSTS enforces HTTPS in the browser; it does not issue or renew the certificate that makes HTTPS possible.

Learn more from Bitfoo

Sources

Last reviewed 2026-07-19.