HSTS: Forcing Future Connections to Use HTTPS

HTTP Strict Transport Security (HSTS) is a response header that tells browsers to only use HTTPS for your site, automatically upgrading future HTTP requests. It prevents man-in-the-middle attacks like SSL stripping by ensuring the upgrade to a secure connection happens client-side. The header is ignored if sent over HTTP. The biggest footgun: once a browser learns an HSTS policy, it will refuse to connect if there's a certificate error, with no option for the user to bypass the warning. This makes a bad certificate a complete outage.