HTTP Strict Transport Security is a mechanism through which web servers declare themselves to be accessible only over secure connections (HTTPS). This mechanism is implemented by configuring the web server to send a HSTS header in its responses. A typical HSTS header looks like the following:
Strict-Transport-Security: max-age=31536000; includeSubDomains
The RFC standard for HTTP Strict Transport Security – RFC6797 specifies under Section 7.2 that a web server should not include this header in plain-text HTTP responses.Continue Reading…