HSTS (HTTP Strict Transport Security)
A response header that tells browsers to reach your domain only over HTTPS for a set time, so nobody can downgrade the connection.
Defined in RFC 6797, the header carries a max-age and optionally includeSubDomains. After the first visit the browser rewrites every http link to https by itself. The preload list goes further: browsers ship with your domain built in, so even the very first visit is protected, but removal takes months, so every subdomain must serve HTTPS first.
Related terms
- CSP (Content Security Policy): An HTTP header that tells the browser which scripts, styles and connections a page may use, limiting the damage of injected code.
- WAF (web application firewall): A filter in front of a web app that blocks malicious HTTP requests before they reach your code.
- CORS (cross-origin resource sharing): Headers that tell the browser which other websites may read responses from your API.
