HSTS
HSTS · HTTP Strict Transport Security · Strict-Transport-Security · HSTS preload · HSTS preload list
A security header through which a website tells the browser to connect to it over HTTPS only, which stops an attacker from downgrading the connection to unencrypted HTTP.
In practice
The site sends the Strict-Transport-Security header with a duration, max-age, expressed in seconds: during that period, the browser automatically turns any HTTP link into HTTPS and refuses to let the user click through a certificate error. The includeSubDomains directive extends the rule to every subdomain. That leaves the very first visit, which is covered by the preload list built into browsers (hstspreload.org): to get on it you need a max-age of at least one year (31,536,000 seconds), includeSubDomains and the preload directive. Getting off the list takes time, so first make sure all your subdomains work over HTTPS.
Fictional case: on hotel Wi-Fi, an attacker intercepts a guest’s first HTTP request to their bank’s website to keep it on HTTP. Because the domain is HSTS-preloaded, the browser never makes that request in clear text and the attack fails.
How to protect yourself
- Start with a short max-age, check, then move up to one year or more.
- Add includeSubDomains once every subdomain is served over HTTPS.
- Submit your main domains to the preload list.
