AiVibeHTTP Strict Transport Security (HSTS)
A web security policy, delivered through the Strict-Transport-Security response header, that tells browsers to connect to a site only over HTTPS for a set period, preventing protocol downgrade and cookie hijacking attacks.
When a browser receives the Strict-Transport-Security header over a valid HTTPS connection, it records the policy for the number of seconds given in the max-age directive. During that time it automatically converts any HTTP link or typed address for the site into HTTPS and does not let users click through certificate errors. The includeSubDomains directive extends the policy to all subdomains. HSTS is defined in IETF RFC 6797.
Without HSTS, a user's first request to a site over plain HTTP can be intercepted on hostile networks such as public Wi-Fi and downgraded in an SSL stripping attack. HSTS closes this gap for returning visitors, and the HSTS preload list, maintained by the Chromium project and used by other major browsers, protects even the first visit for domains that are submitted to it.
Before enabling HSTS, every subdomain and resource must work over HTTPS, because the policy blocks plain HTTP access for the full max-age period, and removal from the preload list takes time. Deployment usually starts with a short max-age that is increased once everything is confirmed; preload submission requires a max-age of at least one year, the includeSubDomains directive and the preload directive. HSTS complements correct TLS configuration and HTTP-to-HTTPS redirects rather than replacing them.
Key points
- Forces browsers to use HTTPS for a domain for a set max-age period.
- Defeats SSL stripping and protocol downgrade attacks.
- The preload list protects even a user's first visit.
- All subdomains must support HTTPS before includeSubDomains is used.
Where AiVibe comes in
AiVibe is ISO/IEC 27001:2022 certified, and its security services include vulnerability assessment and penetration testing, code security analysis (SAST, DAST, IAST, SCA), compliance gap analysis and 24/7 monitoring; AiVedha.ai runs more than 170 automated website security checks.