Security
HSTS
HTTP Strict Transport Security
HTTP Strict Transport Security (HSTS) is an HTTP response header that tells browsers to access the site only over HTTPS for a specified duration. It prevents protocol-downgrade attacks and accidental insecure links.
Part of Security header monitoring — the full answer, the facts and the alternatives in one place.
In depth
Once a browser sees `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` it refuses to make any HTTP connection to the domain for a year, even if the user types `http://`. With `preload`, the policy is baked into Chrome and Firefox themselves.
This means HSTS is a one-way street: shipping a long max-age and then needing to switch back to HTTP is impossible without affecting every returning visitor for up to a year.
Why it matters
HSTS closes the SSL-stripping attack vector on public Wi-Fi, defends against accidentally serving sensitive content over HTTP after a deploy mistake, and is required for top scores in security-header audits like Mozilla Observatory.
How Lemwatch helps with hsts
Lemwatch monitors hsts continuously and alerts you the moment something changes.
Security headers →Related terms
SSL/TLS
SSL/TLS is the cryptographic protocol that secures HTTPS connections. It encrypts traffic between browser and …
Security Headers
Security headers are HTTP response headers that instruct browsers to enforce additional defences against commo…
CSP
Content Security Policy (CSP) is an HTTP response header that restricts which sources a browser may load scrip…
DMARC
DMARC is an email authentication protocol that lets a domain owner publish a policy specifying how mailbox pro…
SPF
Sender Policy Framework (SPF) is an email authentication standard that publishes the list of IP addresses auth…
Browse the full Lemwatch monitoring glossary (47 terms).