thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

HTTP Strict Transport Security (HSTS)

HTTP response header instructing browsers to connect to a site only over HTTPS for a set time.

Definition

HSTS prevents protocol downgrade and SSL stripping attacks and stops users from clicking through certificate warnings. Sites can be added to browser preload lists so even the first visit uses HTTPS. Misconfiguration can lock users out if HTTPS breaks.

Example

After receiving an HSTS header, a browser rewrites http://bank.example to https:// automatically.

Exam tip

HSTS is the fix for SSL stripping.

Related terms