HSTS
HTTP Strict Transport Security
A response header with which a site tells browsers to connect to it only over HTTPS for max-age seconds, optionally including subdomains, which stops downgrades to plain HTTP after the first visit; the browsers’ preload list covers the first visit too.
- Also called
- Strict-Transport-Security
- Defined in
- RFC 6797
Covered in
Guide
Configure HTTP security headers from a tested baseline
Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.
Guide
Operate TLS and certificates: configuration, renewal and verification
Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.
Practice: CSP builder lab: Build a strict Content-Security-Policy