---
title: "HSTS (HTTP Strict Transport Security) — monitoring glossary"
description: "HTTP Strict Transport Security (HSTS) is an HTTP response header that tells browsers to access the site only over HTTPS for a specified duration. It prevents…"
canonical: "https://lemwatch.com/glossary/hsts"
source: "https://lemwatch.com"
---

# HSTS (HTTP Strict Transport Security)

> HTTP Strict Transport Security (HSTS) is an HTTP response header that tells browsers to access the site only over HTTPS for a specified duration. It prevents protocol-downgrade attacks and accidental insecure links.

## Definition

 Once a browser sees `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` it refuses to make any HTTP connection to the domain for a year, even if the user types `http://`. With `preload`, the policy is baked into Chrome and Firefox themselves.

 This means HSTS is a one-way street: shipping a long max-age and then needing to switch back to HTTP is impossible without affecting every returning visitor for up to a year.

## Why it matters

 HSTS closes the SSL-stripping attack vector on public Wi-Fi, defends against accidentally serving sensitive content over HTTP after a deploy mistake, and is required for top scores in security-header audits like Mozilla Observatory.

 See it in the product: [Security headers](https://lemwatch.com/features).


## Related

- [Monitoring glossary](https://lemwatch.com/glossary)
- [SSL/TLS](https://lemwatch.com/glossary/ssl)
- [Security Headers](https://lemwatch.com/glossary/security-headers)
- [CSP](https://lemwatch.com/glossary/csp)
- [DMARC](https://lemwatch.com/glossary/dmarc)
- [All monitoring checks](https://lemwatch.com/features)
- [Incident](https://lemwatch.com/glossary/incident)
- [Five Nines (99.999% uptime)](https://lemwatch.com/glossary/five-nines)