---
title: "HSTS (HTTP Strict Transport Security)"
description: "HSTS forces HTTPS connections and defends against downgrade and SSL stripping attacks. Learn the header, its directives, preload lists and safe rollout."
url: "https://nodea.io/en/glossary/hsts"
lang: "en"
updated: "2026-07-13"
---

# HSTS (HTTP Strict Transport Security)

> HSTS (HTTP Strict Transport Security) is a security mechanism that forces a browser to connect to a site only over the encrypted HTTPS protocol. It defends against downgrade attacks and session hijacking on an unencrypted connection.

**HSTS** (HTTP Strict Transport Security) is a security policy delivered through an HTTP header that instructs a browser to communicate with a given domain exclusively over the encrypted [HTTPS](https://nodea.io/en/glossary/https) protocol. Once received, the browser automatically upgrades every *http://* request to *https://* before it is ever sent, eliminating the risk of an intercepted plaintext connection. The standard is defined in RFC 6797.

## How HSTS works

The server sends a *Strict-Transport-Security* header in its HTTPS responses. The browser remembers the policy for the duration set by the *max-age* directive (in seconds) and, throughout that period, refuses any plain HTTP connection to the domain. The key directives are:

- **max-age** — how long the policy stays in effect, typically one year (31536000 seconds).
- **includeSubDomains** — extends the policy to all subdomains.
- **preload** — submits the domain to the list hard-coded into browsers.

HSTS specifically neutralizes the *SSL stripping* attack, in which a [man-in-the-middle](https://nodea.io/en/glossary/man-in-the-middle) attacker rewrites secure links to HTTP versions. Because a browser holding the policy never even attempts an unencrypted connection, such a downgrade becomes impossible.

## Practical application

HSTS is standard in banking, admin panels and online stores, where protecting the session is critical. It is deployed by adding the header in the web server configuration (Apache, Nginx) or in an [.htaccess](https://nodea.io/en/glossary/htaccess) file. The recommended sequence: first confirm that the entire site, including subdomains, works correctly over HTTPS with a valid [TLS](https://nodea.io/en/glossary/tls) certificate, then set a short max-age and gradually increase it, and only at the end consider submitting to the preload list. HSTS is usually rolled out alongside other [security headers](https://nodea.io/en/glossary/security-headers) such as CSP and X-Frame-Options.

### What is the HSTS preload list?

It's a list built into browsers of domains that should always load over HTTPS — even on the very first visit, before the browser receives any header. You submit a domain at hstspreload.org, but the decision is effectively irreversible, so it requires certainty that the entire site and all subdomains work over HTTPS.

## Related

- [HTTPS](https://nodea.io/en/glossary/https)
- [TLS](https://nodea.io/en/glossary/tls)
- [SSL](https://nodea.io/en/glossary/ssl)
- [Man in the middle](https://nodea.io/en/glossary/man-in-the-middle)
- [Security Headers](https://nodea.io/en/glossary/security-headers)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/hsts.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)