DNS & Glossary

HSTS (HTTP Strict Transport Security)

A response-header policy that forces browsers to use HTTPS for a domain, blocking protocol-downgrade and SSL-stripping attacks.

What it is

The Strict-Transport-Security header tells the browser to remember, for max-age seconds, that the site must only be reached over HTTPS. This stops downgrade attacks that intercept the initial plaintext request. Adding preload lets you submit the domain to a list browsers ship with, protecting even the first visit.

HTTP RESPONSE HEADER
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Why it matters

  • It closes the SSL-stripping gap left by an initial http:// request or a typed bare domain.
  • Preloading protects even the very first connection to a domain.

Common mistakes

  • Enabling includeSubDomains or preload before every subdomain supports HTTPS, locking out those hosts.
  • Setting a tiny max-age that provides little protection.

How WebInspect checks this

  • WebInspect reports the HSTS header, its max-age, includeSubDomains and preload flags in the security analysis.