TL;DR
HSTS (HTTP Strict Transport Security) is a web security policy that tells browsers to connect to a website only over HTTPS. Once a browser receives the Strict-Transport-Security header, it automatically upgrades every HTTP request to HTTPS and blocks users from bypassing certificate errors, preventing SSL-stripping and man-in-the-middle attacks.
In this article, you will learn what an HSTS certificate is, how to implement HSTS, and how HSTS stops SSL stripping attacks.
HSTS Meaning: What Does HSTS Stand For?
HSTS stands for HTTP Strict Transport Security. It’s an internet safety policy that tells browsers to connect with an internet site most effectively via a secure HTTPS connection, by no means through simple HTTP.
HSTS became brought in 2012 as an reliable web popular (RFC 6797) and is now supported by means of all major browsers, such as Chrome, Firefox, Safari, and Edge.
How Does HSTS Work?
HSTS works via an easy alternative between the website and the browser:
- First go to over HTTPS. A consumer visits a website that has a legitimate SSL certificate and HTTPS enabled.
- The server sends the HSTS header. Along with the page, the server sends a response header like this:
Strict-Transport-Security: max-age=31536000; includeSubDomains
- The browser saves the policy. The browser stores this rule for the time set in max-age. In this example, that’s 31,536,000 seconds, or 12 months. If includeSubDomains is protected, the rule of thumb also covers each subdomain.
- Future visits are automatically upgraded. From then on, whenever the user attempts to open the website over HTTP, the browser converts the request to HTTPS internally before anything is sent over the internet. No unencrypted request ever leaves the tool.
- Certificate errors can’t be bypassed. If the website’s SSL certificate is invalid or expired, the browser blocks the page absolutely in preference to letting customers click via a warning. This stops attackers from using a fake certificate to intercept site visitors.
The first-go to gap: HSTS only takes effect after the browser has seen the header at least once, so the first actual go-to can still be uncovered. HSTS preload solves this by means of building your domain into the browser itself, so HTTPS is enforced from the first connection.
What Is HSTS Preload?
HSTS preload is a list of domains built directly into browsers like Chrome, Firefox, Safari, and Edge that are always loaded over HTTPS, even on a user’s very first visit. Normally, HSTS only works after the browser has received the header once, which leaves the first connection exposed. Preloading closes that gap.
To qualify, your site needs a valid SSL certificate, must redirect HTTP to HTTPS, serve all subdomains over HTTPS, and send the header Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
You can then submit your domain at hstspreload.org.
Be careful: Removal from the list can take months, so only preload when your entire domain is fully HTTPS-ready.
Also Read: What is the HSTS Preload List for Chrome? How to Add Domain to HSTS Preload List?
What is the Purpose of HSTS?
HSTS (HTTP Strict Transport Security) is a web security mechanism that tells browsers: Always use HTTPS when connecting to this site—never use HTTP. This helps ensure secure, encrypted connections and protects users from man-in-the-middle (MITM) and Stripping attacks.
What is HSTS Encryption?
When you want to keep your information private on the internet, using a secret code can boost your chances of preventing third parties from reading it. This can be done using encryption, which completely scrambles your message to prevent both humans and machines from being able to make sense of it.
When your message reaches the destination, the receiver can use a key to unscramble it in a process known as decryption. Currently, encryption is done in two ways – symmetric vs asymmetric encryption.
| Symmetric Encryption | Asymmetric Encryption |
| Symmetric Encryption uses a single key for encryption and decryption. This key is shared over an unsecured network. | Asymmetric Encryption uses separate key pairs of encrypting keys(public keys) and decrypting keys(private keys) for both parties. The private keys are never shared. |
| It is faster but less secure. | It Is extremely secure but quite slow. |
As you can see, symmetric encryption has one obvious vulnerability, which lets an attacker intercept the key before the connection is encrypted. While not so obvious, asymmetric encryption can also be quite vulnerable to interception. While the attacker may not be able to access the private key, they can get access to the public key in this case.
Using the public key, the attacker could encrypt malicious code and send it to the client, making it seem like it came from the server. This could include anything from spyware to ransomware. Fortunately, there is a way to determine each communication’s authenticity over a secured network.
Are HSTS and HTTPS the same?
No, HSTS and HTTPS are not the same, though they are related in the following terms:
HTTPS is a protocol that encrypts communication between a browser and a website using TLS. Whereas HSTS is a security policy that a website sends to the browser using an HTTP header. HTTPS can exist without HSTS but HSTS requires HTTPS to function.
HSTS vs HTTPS: What’s the Difference?
HTTPS and HSTS play together, but they do exceptional jobs. HTTPS encrypts the connection between a browser and a website through the use of SSL/TLS certificates. HSTS (HTTP Strict Transport Security) is a security policy that tells the browser to usually use HTTPS for that website online, so the encrypted connection can’t be skipped, downgraded, or bypassed.
In short, HTTPS provides the secure connection, and HSTS makes certain browsers never join another way.
| Feature | HTTPS | HSTS |
|---|---|---|
| What it is | A secure version of HTTP that encrypts facts the usage of SSL/TLS | A protection coverage introduced through the Strict-Transport-Security reaction header |
| Main reason | Encrypts information in transit between browser and server | Forces browsers to use HTTPS only, on each visit |
| Requires an SSL certificates | Yes | Yes, it only works on a domain already served over valid HTTPS |
| How it’s enabled | Install an SSL/TLS certificate on the server | Add the HSTS header to HTTPS responses (or submit to the HSTS preload list) |
| Handles HTTP requests | Relies on a server-facet 301 redirect, so the first request still goes out over unencrypted HTTP | The browser upgrades HTTP to HTTPS internally (307 redirect) before any request leaves the tool |
| Protection towards SSL stripping | Vulnerable, considering the fact that an attacker can intercept the initial HTTP request and preserve the person on HTTP | Protected after the primary visit, and from the very first visit with HSTS preload |
| Certificate warnings | Users can click via invalid-certificates warnings | Browsers block click on-thru, so customers can’t bypass certificate mistakes |
| Scope | Applies to every connection in my view | Remembered by the browser for the max-age duration and can cover all subdomains with includeSubDomains |
| Effect if misconfigured | Browser shows a safety warning | Site can end up unreachable till the certificates is constant or max-age expires |
| search engine optimization impact | Confirmed Google ranking signal | No direct ranking increase, however it eliminates redirect hops and strengthens HTTPS signals |
Do You Need Both?
Yes. HSTS can’t work without HTTPS, because browsers ignore the HSTS header when it’s sent over plain HTTP. And HTTPS alone leaves a gap: the first HTTP request before the redirect, plus any user who clicks past a certificate warning. Enabling HSTS on top of a valid SSL certificate closes that gap and gives visitors encrypted connections on every visit.
The Vulnerability
The vulnerability this system presents isn’t very complicated. Simply put, websites need time to establish an SSL handshake, and during that brief period, they connect to their clients using an http:// connection. This leaves the connection vulnerable to attacks.
Exploits of this vulnerability include sending phishing login pages to the client by redirection or even stripping an SSL connection while leaving the connection unsecured and unencrypted.
How to Fix the HSTS Error in Chrome?
HSTS stands for HTTP Strict Transport Security, and it isn’t a new technology. It was invented back in 2012, but it has taken a long time to implement fully. This policy prevents websites from accepting any HTTP connections at all, thereby directly connecting with their clients using HTTPS.
Also Read: How To Fix the HSTS Missing from HTTPS Server Error?
In general, browsers try to connect to websites using HTTP; however, this gets changed thanks to HSTS, which sends instructions to browsers to adhere strictly to HTTPS connections only. While this still leaves you vulnerable the first time you connect to the website, it can be delivered via HTTPS to ensure maximum security.
How to Implement HSTS in Apache/Nginx/IIS?
Implementing HSTS requires an SSL certificate. In the case of several subdomains on your website, you would need a Wildcard Certificate, but in other cases, just about any cheap SSL certificate would work.
Once you have the certificate, you can implement HSTS with the following code:
For Apache Web Server
# Use HTTP Strict Transport Security to force client to use secure connections only
<VirtualHost 192.168.1.1:443>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</VirtualHost>For lighttpd
server.modules += ( "mod_setenv" ) $HTTP["scheme"] == "https" { setenv.add-response-header = ("Strict-Transport-Security" => "max-age=300; includeSubDomains; preload") }For NGINX
add_header Strict-Transport-Security 'max-age=300; includeSubDomains; preload; always;'For IIS Servers
protected void Application_BeginRequest(Object sender, EventArgs e) { switch (Request.Url.Scheme) { case "https": Response.AddHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload"); break; case "http": var path = "https://" + Request.Url.Host + Request.Url.PathAndQuery; Response.Status = "301 Moved Permanently"; Response.AddHeader("Location", path); break; } }Also Read: How to Disable HSTS in Chrome & Firefox?
Final Thoughts
While it has been in use for over a decade, HSTS has become necessary for making the World Wide Web a more secure place. Implement it on your website today for maximum security for your users.
