HTTP Strict Transport Security (HSTS) is an HTTP response header that tells browsers to access the site only over HTTPS for a specified duration. It prevents protocol-downgrade attacks and accidental insecure links.
Once a browser sees `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` it refuses to make any HTTP connection to the domain for a year, even if the user types `http://`. With `preload`, the policy is baked into Chrome and Firefox themselves.
This means HSTS is a one-way street: shipping a long max-age and then needing to switch back to HTTP is impossible without affecting every returning visitor for up to a year.
HSTS closes the SSL-stripping attack vector on public Wi-Fi, defends against accidentally serving sensitive content over HTTP after a deploy mistake, and is required for top scores in security-header audits like Mozilla Observatory.
See it in the product: Security headers.