Strict-Transport-Security
HSTS: this site is HTTPS-only; browsers must not even try HTTP for max-age seconds.
response header
Example
Strict-Transport-Security: max-age=31536000; includeSubDomains
- What it does
- HSTS: this site is HTTPS-only; browsers must not even try HTTP for max-age seconds.
- In practice
- After the first visit, the browser upgrades every future http:// attempt itself — removing the interceptable redirect hop. Two cautions: includeSubDomains means EVERY subdomain must be HTTPS-ready (that forgotten internal tool included), and preload is close to irreversible — you are asking to be hardcoded into browsers.