Abstract
The HTTP Strict-Transport-Security
response header (often abbreviated as HSTS) lets a web site tell browsers that it should only be accessed using HTTPS, instead of using HTTP.
The HTTP Strict Transport Security header informs the browser that it should never load a site using HTTP and should automatically convert all attempts to access the site using HTTP to HTTPS requests instead.
The
Strict-Transport-Security
header is ignored by the browser when your site is accessed using HTTP; this is because an attacker may intercept HTTP connections and inject the header or remove it. When your site is accessed over HTTPS with no certificate errors, the browser knows your site is HTTPS capable and will honor theStrict-Transport-Security
header.
Read more in
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security