HSTS in plain English.

The problem it solves

Your site redirects HTTP to HTTPS. Good - but the redirect itself happens over plain HTTP, and anyone positioned on the network (public Wi-Fi is enough) can intercept that first plaintext request and keep the victim on an attacker-controlled plain connection. The user typed your domain; the padlock never appears; nobody notices.

HSTS - HTTP Strict Transport Security - removes the plaintext step on every visit after the first. The browser itself refuses to speak HTTP to your domain.

How it works

You send one header over HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains

The browser remembers: for the next year (max-age in seconds), upgrade every request to this domain to HTTPS internally - before anything touches the network. Typed http:// URLs, old links, embedded assets: all silently rewritten client-side. The downgrade window is gone.

The first-visit gap - and preload

HSTS is remembered, which means the very first contact with your site is still unprotected. For most sites that residual risk is acceptable. If it is not, the preload list closes it: browsers ship with a built-in list of domains that are HTTPS-only from the factory. You submit at hstspreload.org once your header carries a one-year max-age, includeSubDomains, and the preload token.

The footgun

includeSubDomains means every subdomain, including the ones you forgot: the legacy intranet host, the vendor CNAME, the printer portal that only speaks HTTP. Ship the header on your apex with a year-long max-age and one HTTP-only subdomain, and that subdomain is unreachable for your users - for up to a year, cached in browsers you cannot reach. Preload makes it stronger and slower to undo: removal from the list takes months to propagate.

This is the only common way to hurt yourself with HSTS, and it is entirely avoidable: inventory subdomains first.

A sane rollout

1. Inventory every subdomain that receives traffic. Confirm each serves HTTPS.
2. Ship with max-age=300 (five minutes). Break something? It heals in five minutes.
3. Raise to a week. Watch logs and support tickets.
4. Raise to a year, add includeSubDomains.
5. Optionally add preload and submit - once you are confident you will never need plain HTTP again. Treat preload as close to permanent.

Keep the HTTP-to-HTTPS redirect: it still catches first-time visitors. HSTS protects everyone after that.

One header, staged over three weeks. The downgrade attack retires.