Glossary term
What is HSTS (HTTP Strict Transport Security)?
HSTS stands for HTTP Strict Transport Security.
In System Design
Tells browsers to always use HTTPS for a site. Example: Even if you type http://bank.com, the browser goes to https://.
Learn it properly · System DesignLesson 3: HTTP & HTTPS Explained: Methods, Status Codes and TLSHTTP is the shared language of the web: a method and URL in, a status code and body out. HTTPS wraps it in TLS so nobody on the path can read or change it. Methods, idempotency, status codes, HTTP/1.1 vs 2 vs 3, and the TLS handshake.In The Browser Contract
A header that tells the browser: always use HTTPS for this site. The browser then never sends the first request in plain, unsafe form.
Learn it properly · The Browser ContractLesson 0: What Happens When You Type a URL (The Full Version)The full trip from pressing Enter to seeing pixels: DNS, TCP, TLS, HTTP, then reading the page and painting it. Caches skip most steps. Every other lesson in this series fits on this map.In Security for Developers
A response header that tells the browser to always use HTTPS for your site for a set time, and not to allow clicking through certificate warnings.
Learn it properly · Security for DevelopersLesson 5: Secrets, Encryption and Data ProtectionWhere secrets leak (git, logs, front-end bundles), hashing vs encryption vs encoding, TLS in plain words, safe randomness, encrypting data with AES-GCM, and handling personal data.In Networking for Developers
A response header that tells the browser to use HTTPS only for this site for a set time.
Learn it properly · Networking for DevelopersLesson 5: TLS and Certificates: How HTTPS Really WorksThe handshake in plain words, certificates and chains, Let's Encrypt, mTLS, and the errors you will meet.