Learn a policy only through error-free secure transport
01HTTP Strict Transport Security (HSTS) is a remembered browser policy. A website sends a Strict-Transport-Security response header over HTTPS, which carries HTTP over Transport Layer Security (TLS). The browser, called a user agent, can then insist on secure connections to that host.
Separate subsequent connection attempt: certificate validation reports an error. The browser terminates this connection before an HTTP response is accepted. HSTS does not repair the certificate or authorize a bypass.
Source for this drawing: RFC 6797 · Read RFC section 8.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The browser learns securely, then upgrades future HTTP loads before sending them.
- An HSTS host SHOULD include the header in secure responses. If included, the host MUST send only one and it MUST satisfy the specified syntax. Sending it in every response is a SHOULD, not an unconditional MUST.
- The browser MUST process a valid policy received over secure transport without errors or warnings. It MUST ignore HSTS headers received over insecure transport; the server MUST NOT send them there.
- For an applicable known host, the browser MUST replace an HTTP URL’s scheme with HTTPS before loading it. This happens locally, without first sending an insecure request to obtain a redirect.
- When connecting to a known HSTS host, any underlying secure-transport error or warning requires the browser to terminate the connection. Certificate-validation or server-identity errors do not become a successful connection after a warning is clicked.
All hosts and clocks are fictional. No live security policy is changed by this guide. The HTTPS arrows abbreviate a successful TLS connection; they do not replace the TLS handshake guide.
Read the RFC section ↗