HSTS: Forcing Future Connections to Use HTTPS
HSTS is a response header that tells browsers to only use HTTPS for your site, automatically upgrading future HTTP requests. This prevents SSL stripping attacks.
Why it exists
Even if a site offers HTTPS, users might first connect via an insecure HTTP link or by typing the domain name without a scheme. This initial insecure request can be intercepted by an attacker in a "SSL stripping" attack, keeping the user on an unencrypted connection. HSTS was created to close this vulnerability for repeat visitors.
The mental model
Think of HSTS as a browser-side, long-term memory rule. After the first secure visit, the browser notes, "Always use HTTPS for this domain, no exceptions." It's a promise from the server that it will always be available over a secure channel, and the browser enforces that promise on all future requests.
How it works
A server includes the Strict-Transport-Security header in an HTTPS response. The browser sees this and adds the domain to an internal HSTS list for the duration specified by the max-age directive (in seconds). On any subsequent attempt to access the domain via http://, the browser internally rewrites the URL to https:// before sending the request over the network. This happens entirely client-side.
When to use it
Use HSTS on any site that is fully and permanently migrated to HTTPS. It is a critical security layer for applications handling sensitive data, like e-commerce, banking, or user logins. It hardens your site against downgrade attacks and ensures user connections remain encrypted after their first visit.
When not to use it
Do not enable HSTS if parts of your site or subdomains must be served over HTTP, as the includeSubDomains directive can block access to them. Start with a short max-age for testing. A long max-age is a strong commitment; if your TLS certificate management is unstable, HSTS will turn certificate errors from a warning into a hard failure, blocking users from your site entirely.
One canonical example
A user visits https://example.com. The server responds with Strict-Transport-Security: max-age=31536000. The next day, the user clicks an old link to http://example.com/login. The browser, remembering the HSTS policy, immediately changes the request to https://example.com/login before it leaves the machine. If example.com's certificate has expired, the browser will show an error and refuse to connect, with no option to proceed.
Interview question
What is a critical consequence of deploying a website with a long-duration HSTS policy?
- a.It shifts the burden of HTTP to HTTPS redirection from the web server to the client's browser.
- b.It can prevent users from accessing the site if the TLS certificate becomes invalid or expires.Correct
- c.It ensures that all user requests, including the very first visit, are always encrypted.
- d.It requires users to install a special browser plugin to enforce the security policy.
Why? this is the answer
A long-duration HSTS policy means the browser will strictly enforce HTTPS for the specified period. If the site's TLS certificate expires or becomes invalid during this time, the browser will block access entirely, as stated in the card. While HSTS does manage redirection client-side (option A), this is its mechanism, not the primary 'critical consequence' or risk of a long-duration policy.
Just read this? Test yourself on what you have been reading.
Read the original → developer.mozilla.org
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on security — each one lists the topics its interview covers.
See open roles