{"id":390,"date":"2022-10-28T11:00:00","date_gmt":"2022-10-28T11:00:00","guid":{"rendered":"https:\/\/cheapsslweb.com\/resources\/?p=390"},"modified":"2026-10-22T06:19:46","modified_gmt":"2026-10-22T06:19:46","slug":"what-is-hsts-certificate","status":"publish","type":"post","link":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/","title":{"rendered":"What Is HSTS (HTTP Strict Transport Security)?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">TL;DR<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>HSTS (HTTP Strict Transport Security)<\/strong> is a web security policy that tells browsers to connect to a website only over HTTPS. Once a browser receives the <code>Strict-Transport-Security<\/code> header, it automatically upgrades every HTTP request to HTTPS and blocks users from bypassing certificate errors, preventing SSL-stripping and man-in-the-middle attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, you will learn what an HSTS certificate is, how to implement HSTS, and how HSTS <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-ssl-stripping\/\">stops SSL stripping attacks<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ufeffHSTS Meaning: What Does HSTS Stand For?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>HSTS stands for HTTP Strict Transport Security<\/strong>. It\u2019s an internet safety policy that tells browsers to connect with an internet site most effectively via a secure HTTPS connection, by no means through simple HTTP.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">HSTS became brought in 2012 as an reliable web popular (<a href=\"https:\/\/www.rfc-editor.org\/info\/rfc6797\/\">RFC 6797<\/a>) and is now supported by means of all major browsers, such as Chrome, Firefox, Safari, and Edge.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">How Does HSTS Work?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HSTS works via an easy alternative between the website and the browser:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>First go to over HTTPS<\/strong>. A consumer visits a website that has a <a href=\"https:\/\/cheapsslweb.com\/\">legitimate SSL certificate<\/a> and HTTPS enabled.<\/li>\n\n\n\n<li><strong>The server sends the HSTS header<\/strong>. Along with the page, the server sends a response header like this:<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Strict-Transport-Security: max-age=31536000; includeSubDomains<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>The browser saves the policy<\/strong>. The browser stores this rule for the time set in max-age. In this example, that\u2019s 31,536,000 seconds, or 12 months. If includeSubDomains is protected, the rule of thumb also covers each subdomain.<\/li>\n\n\n\n<li><strong>Future visits are automatically upgraded<\/strong>. From then on, whenever the user attempts to open the website over HTTP, the browser converts the request to HTTPS internally before anything is sent over the internet. No unencrypted request ever leaves the tool.<\/li>\n\n\n\n<li><strong>Certificate errors can\u2019t be bypassed<\/strong>. If the <a href=\"https:\/\/cheapsslweb.com\/blog\/what-happens-when-your-ssl-certificate-expires-how-to-renew\/\">website\u2019s SSL certificate is invalid or expired<\/a>, the browser blocks the page absolutely in preference to letting customers click via a warning. This stops attackers from using a fake certificate to intercept site visitors.<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>The first-go to gap: <\/strong>HSTS only takes effect after the browser has seen the header at least once, so the first actual go-to can still be uncovered. HSTS preload solves this by means of building your domain into the browser itself, so HTTPS is enforced from the first connection.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">What Is HSTS Preload?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HSTS preload is a list of domains built directly into browsers like Chrome, Firefox, Safari, and Edge that are always loaded over HTTPS, even on a user\u2019s very first visit. Normally, HSTS only works after the browser has received the header once, which leaves the first connection exposed. Preloading closes that gap. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To qualify, your site needs a valid SSL certificate, must <a href=\"https:\/\/cheapsslweb.com\/blog\/http-to-https-migration-the-complete-guide\/\">redirect HTTP to HTTPS<\/a>, serve all subdomains over HTTPS, and send the header <code>Strict-Transport-Security: max-age=31536000; includeSubDomains; preload<\/code>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can then submit your domain at hstspreload.org. <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Be careful: <\/strong>Removal from the list can take months, so only preload when your entire domain is fully HTTPS-ready.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/cheapsslweb.com\/resources\/what-is-the-hsts-preload-list-for-chrome-how-to-add-domain-to-the-hsts-preload-list\/\"><strong>What is the HSTS Preload List for Chrome? How to Add Domain to HSTS Preload List?<\/strong><\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is the Purpose of HSTS?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HSTS (HTTP Strict Transport Security) is a web security mechanism that tells browsers: Always use HTTPS when connecting to this site\u2014never use HTTP. This helps ensure secure, encrypted connections and protects users from man-in-the-middle (MITM) and Stripping attacks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is HSTS Encryption?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When you want to keep your information private on the internet, using a secret code can boost your chances of preventing third parties from reading it. This can be done using encryption, which completely scrambles your message to prevent both humans and machines from being able to make sense of it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When your message reaches the destination, the receiver can use a key to unscramble it in a process known as decryption. Currently, encryption is done in two ways \u2013 <a href=\"https:\/\/cheapsslweb.com\/blog\/symmetric-encryption-vs-asymmetric-encryption\/\">symmetric vs asymmetric encryption.<\/a><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>Symmetric Encryption<\/strong><\/td><td><strong>Asymmetric Encryption<\/strong><\/td><\/tr><tr><td>Symmetric Encryption uses a single key for encryption and decryption. This key is shared over an unsecured network.<\/td><td>Asymmetric Encryption uses separate key pairs of encrypting keys(public keys) and decrypting keys(private keys) for both parties. The private keys are never shared.<\/td><\/tr><tr><td>It is faster but less secure.<\/td><td>It Is extremely secure but quite slow.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">As you can see, <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-symmetric-key-encryption\/\">symmetric encryption<\/a> has one obvious vulnerability, which lets an attacker intercept the key before the connection is encrypted. While not so obvious, <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-asymmetric-encryption-how-does-it-work\/\">asymmetric encryption<\/a> can also be quite vulnerable to interception. While the attacker may not be able to access the private key, they can get access to the public key in this case.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using the public key, the attacker could encrypt malicious code and send it to the client, making it seem like it came from the server. This could include anything from <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-spyware-and-spyware-examples\/\">spyware<\/a> to ransomware. Fortunately, there is a way to determine each communication&#8217;s authenticity over a secured network.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Are HSTS and HTTPS the same?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">No, HSTS and HTTPS are not the same, though they are related in the following terms:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS is a protocol that encrypts communication between a browser and a website using TLS. Whereas HSTS is a security policy that a website sends to the browser using an HTTP header. HTTPS can exist without HSTS but HSTS requires HTTPS to function.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">HSTS vs HTTPS: What\u2019s the Difference?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS and HSTS play together, but they do exceptional jobs. HTTPS encrypts the connection between a browser and a website through the use of <a href=\"https:\/\/cheapsslweb.com\/\">SSL\/TLS certificates<\/a>. HSTS (HTTP Strict Transport Security) is a security policy that tells the browser to usually use HTTPS for that website online, so the encrypted connection can\u2019t be skipped, downgraded, or bypassed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In short, HTTPS provides the secure connection, and HSTS makes certain browsers never join another way.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Feature<\/th><th>HTTPS<\/th><th>HSTS<\/th><\/tr><\/thead><tbody><tr><td>What it is<\/td><td>A secure version of HTTP that encrypts facts the usage of SSL\/TLS<\/td><td>A protection coverage introduced through the Strict-Transport-Security reaction header<\/td><\/tr><tr><td>Main reason<\/td><td>Encrypts information in transit between browser and server<\/td><td>Forces browsers to use HTTPS only, on each visit<\/td><\/tr><tr><td>Requires an SSL certificates<\/td><td>Yes<\/td><td>Yes, it only works on a domain already served over valid HTTPS<\/td><\/tr><tr><td>How it\u2019s enabled<\/td><td>Install an SSL\/TLS certificate on the server<\/td><td>Add the HSTS header to HTTPS responses (or submit to the HSTS preload list)<\/td><\/tr><tr><td>Handles HTTP requests<\/td><td>Relies on a server-facet 301 redirect, so the first request still goes out over unencrypted HTTP<\/td><td>The browser upgrades HTTP to HTTPS internally (307 redirect) before any request leaves the tool<\/td><\/tr><tr><td>Protection towards SSL stripping<\/td><td>Vulnerable, considering the fact that an attacker can intercept the initial HTTP request and preserve the person on HTTP<\/td><td>Protected after the primary visit, and from the very first visit with HSTS preload<\/td><\/tr><tr><td>Certificate warnings<\/td><td>Users can click via invalid-certificates warnings<\/td><td>Browsers block click on-thru, so customers can\u2019t bypass certificate mistakes<\/td><\/tr><tr><td>Scope<\/td><td>Applies to every connection in my view<\/td><td>Remembered by the browser for the max-age duration and can cover all subdomains with includeSubDomains<\/td><\/tr><tr><td>Effect if misconfigured<\/td><td>Browser shows a safety warning<\/td><td>Site can end up unreachable till the certificates is constant or max-age expires<\/td><\/tr><tr><td>search engine optimization impact<\/td><td>Confirmed Google ranking signal<\/td><td>No direct ranking increase, however it eliminates redirect hops and strengthens HTTPS signals<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Do You Need Both?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. HSTS can\u2019t work without HTTPS, because browsers ignore the HSTS header when it\u2019s sent over plain HTTP. And HTTPS alone leaves a gap: the first HTTP request before the redirect, plus any user who clicks past a certificate warning. Enabling HSTS on top of a valid SSL certificate closes that gap and gives visitors encrypted connections on every visit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Vulnerability<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability this system presents isn\u2019t very complicated. Simply put, websites need time to establish an <a href=\"https:\/\/cheapsslweb.com\/blog\/ssl-tls-handshake-explained-process-work-and-importance\/\">SSL handshake<\/a>, and during that brief period, they connect to their clients using an <em>http:\/\/<\/em> connection. This leaves the connection vulnerable to attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Exploits of this vulnerability include sending phishing login pages to the client by redirection or even stripping an SSL connection while leaving the connection unsecured and unencrypted.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to Fix the HSTS Error in Chrome?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HSTS stands for HTTP Strict Transport Security, and it isn\u2019t a new technology. It was invented back in 2012, but it has taken a long time to implement fully. This policy prevents websites from accepting any HTTP connections at all, thereby directly connecting with their clients using HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/cheapsslweb.com\/resources\/how-to-fix-the-hsts-missing-from-https-server-error\/\">How To Fix the HSTS Missing from HTTPS Server Error?<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In general, browsers try to connect to websites using HTTP; however, this gets changed thanks to HSTS, which sends instructions to browsers to adhere strictly to HTTPS connections only. While this still leaves you vulnerable the first time you connect to the website, it can be delivered via HTTPS to ensure maximum security.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to Implement HSTS in Apache\/Nginx\/IIS?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Implementing HSTS requires an SSL certificate. In the case of several subdomains on your website, you would need a Wildcard Certificate, but in other cases, just about any <a href=\"https:\/\/cheapsslweb.com\">cheap SSL certificate<\/a> would work.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Once you have the certificate, you can implement HSTS with the following code:<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">For Apache Web Server<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em># Use HTTP Strict Transport Security to force client to use secure connections only <\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;VirtualHost 192.168.1.1:443&gt;  \n  Header always set Strict-Transport-Security \"max-age=31536000; includeSubDomains\"  \n&lt;\/VirtualHost&gt;<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">For lighttpd<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code><em>server.modules += ( \"mod_setenv\" ) $HTTP&#91;\"scheme\"] == \"https\" { setenv.add-response-header = (\"Strict-Transport-Security\" =&gt; \"max-age=300; includeSubDomains; preload\") }<\/em><\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">For NGINX<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code><em>add_header Strict-Transport-Security 'max-age=300; includeSubDomains; preload; always;'<\/em><\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">For IIS Servers<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code><em>protected void Application_BeginRequest(Object sender, EventArgs e) { switch (Request.Url.Scheme) { case \"https\": Response.AddHeader(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains; preload\"); break; case \"http\": var path = \"https:\/\/\" + Request.Url.Host + Request.Url.PathAndQuery; Response.Status = \"301 Moved Permanently\"; Response.AddHeader(\"Location\", path); break; } }<\/em><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/cheapsslweb.com\/blog\/how-to-disable-hsts-settings-in-chrome-firefox\/\">How to Disable HSTS in Chrome &amp; Firefox?<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Final Thoughts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">While it has been in use for over a decade, HSTS has become necessary for making the World Wide Web a more secure place. Implement it on your website today for maximum security for your users.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR HSTS (HTTP Strict Transport Security) is a web security policy that tells browsers to connect to a website only over HTTPS. Once a browser receives the Strict-Transport-Security header, it automatically upgrades every HTTP request to HTTPS and blocks users from bypassing certificate errors, preventing SSL-stripping and man-in-the-middle attacks. In this article, you will learn<span class=\"morelink d-block mt-3\"><a href=\"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/\">Read More<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":417,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[389],"tags":[163,390,392,391],"class_list":["post-390","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ssl-and-encryption","tag-hsts","tag-hsts-certificate","tag-hsts-encryption","tag-http-strict-transport-security-hsts","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Is HSTS? HTTP Strict Transport Security Explained<\/title>\n<meta name=\"description\" content=\"HSTS meaning explained: how HTTP Strict Transport Security works, HSTS vs HTTPS, the preload list, and how to add the HSTS header in Apache, Nginx &amp; IIS.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Is HSTS? HTTP Strict Transport Security Explained\" \/>\n<meta property=\"og:description\" content=\"HSTS meaning explained: how HTTP Strict Transport Security works, HSTS vs HTTPS, the preload list, and how to add the HSTS header in Apache, Nginx &amp; IIS.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/\" \/>\n<meta property=\"og:site_name\" content=\"CheapSSLWeb.com Resources\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cheapsslweb\" \/>\n<meta property=\"article:published_time\" content=\"2022-10-28T11:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-22T06:19:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cheapsslweb.com\/resources\/wp-content\/uploads\/2022\/10\/what-is-hsts-certificate.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"621\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Janki Mehta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cheapsslweb\" \/>\n<meta name=\"twitter:site\" content=\"@cheapsslweb\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/\"},\"author\":{\"name\":\"Janki Mehta\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#\\\/schema\\\/person\\\/c7d26eacacd9392c23be9d82e9af145e\"},\"headline\":\"What Is HSTS (HTTP Strict Transport Security)?\",\"datePublished\":\"2022-10-28T11:00:00+00:00\",\"dateModified\":\"2026-10-22T06:19:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/\"},\"wordCount\":1567,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/what-is-hsts-certificate.jpg\",\"keywords\":[\"hsts\",\"HSTS Certificate\",\"HSTS Encryption\",\"HTTP Strict Transport Security (HSTS)\"],\"articleSection\":[\"SSL and Encryption\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/\",\"name\":\"What Is HSTS? HTTP Strict Transport Security Explained\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/what-is-hsts-certificate.jpg\",\"datePublished\":\"2022-10-28T11:00:00+00:00\",\"dateModified\":\"2026-10-22T06:19:46+00:00\",\"description\":\"HSTS meaning explained: how HTTP Strict Transport Security works, HSTS vs HTTPS, the preload list, and how to add the HSTS header in Apache, Nginx & IIS.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/what-is-hsts-certificate.jpg\",\"contentUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/what-is-hsts-certificate.jpg\",\"width\":960,\"height\":621,\"caption\":\"What is HSTS?\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/what-is-hsts-certificate\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSL and Encryption\",\"item\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/ssl-and-encryption\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"What Is HSTS (HTTP Strict Transport Security)?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#website\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/\",\"name\":\"CheapSSLWeb.com\",\"description\":\"SSL Errors and Installation Tutorials\",\"publisher\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#organization\"},\"alternateName\":\"Cheap SSL Web\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#organization\",\"name\":\"CheapSSLWeb\",\"alternateName\":\"Cheap SSL Web\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/logo.png\",\"contentUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/logo.png\",\"width\":177,\"height\":60,\"caption\":\"CheapSSLWeb\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cheapsslweb\",\"https:\\\/\\\/x.com\\\/cheapsslweb\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/cheapsslweb\\\/\",\"https:\\\/\\\/www.pinterest.com\\\/cheapsslweb\\\/\",\"https:\\\/\\\/www.instagram.com\\\/cheapsslweb\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/#\\\/schema\\\/person\\\/c7d26eacacd9392c23be9d82e9af145e\",\"name\":\"Janki Mehta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"caption\":\"Janki Mehta\"},\"description\":\"Janki Mehta is a Cyber-Security Enthusiast having 7+ years of experience and knowledge about Encryption, Digital Certificates and Online Security, She helps online users to stay safe and protect their online presence. Explore SSL Errors, Installation Guide and Security Tutorials for Safe Browsing and Web Security Experience.\",\"sameAs\":[\"https:\\\/\\\/cheapsslweb.com\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/pw-jankimehta\\\/\"],\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/resources\\\/author\\\/janki-mehta\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Is HSTS? HTTP Strict Transport Security Explained","description":"HSTS meaning explained: how HTTP Strict Transport Security works, HSTS vs HTTPS, the preload list, and how to add the HSTS header in Apache, Nginx & IIS.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/","og_locale":"en_US","og_type":"article","og_title":"What Is HSTS? HTTP Strict Transport Security Explained","og_description":"HSTS meaning explained: how HTTP Strict Transport Security works, HSTS vs HTTPS, the preload list, and how to add the HSTS header in Apache, Nginx & IIS.","og_url":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/","og_site_name":"CheapSSLWeb.com Resources","article_publisher":"https:\/\/www.facebook.com\/cheapsslweb","article_published_time":"2022-10-28T11:00:00+00:00","article_modified_time":"2026-10-22T06:19:46+00:00","og_image":[{"width":960,"height":621,"url":"https:\/\/cheapsslweb.com\/resources\/wp-content\/uploads\/2022\/10\/what-is-hsts-certificate.jpg","type":"image\/jpeg"}],"author":"Janki Mehta","twitter_card":"summary_large_image","twitter_creator":"@cheapsslweb","twitter_site":"@cheapsslweb","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/#article","isPartOf":{"@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/"},"author":{"name":"Janki Mehta","@id":"https:\/\/cheapsslweb.com\/resources\/#\/schema\/person\/c7d26eacacd9392c23be9d82e9af145e"},"headline":"What Is HSTS (HTTP Strict Transport Security)?","datePublished":"2022-10-28T11:00:00+00:00","dateModified":"2026-10-22T06:19:46+00:00","mainEntityOfPage":{"@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/"},"wordCount":1567,"commentCount":0,"publisher":{"@id":"https:\/\/cheapsslweb.com\/resources\/#organization"},"image":{"@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/#primaryimage"},"thumbnailUrl":"https:\/\/cheapsslweb.com\/resources\/wp-content\/uploads\/2022\/10\/what-is-hsts-certificate.jpg","keywords":["hsts","HSTS Certificate","HSTS Encryption","HTTP Strict Transport Security (HSTS)"],"articleSection":["SSL and Encryption"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/","url":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/","name":"What Is HSTS? HTTP Strict Transport Security Explained","isPartOf":{"@id":"https:\/\/cheapsslweb.com\/resources\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/#primaryimage"},"image":{"@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/#primaryimage"},"thumbnailUrl":"https:\/\/cheapsslweb.com\/resources\/wp-content\/uploads\/2022\/10\/what-is-hsts-certificate.jpg","datePublished":"2022-10-28T11:00:00+00:00","dateModified":"2026-10-22T06:19:46+00:00","description":"HSTS meaning explained: how HTTP Strict Transport Security works, HSTS vs HTTPS, the preload list, and how to add the HSTS header in Apache, Nginx & IIS.","breadcrumb":{"@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/#primaryimage","url":"https:\/\/cheapsslweb.com\/resources\/wp-content\/uploads\/2022\/10\/what-is-hsts-certificate.jpg","contentUrl":"https:\/\/cheapsslweb.com\/resources\/wp-content\/uploads\/2022\/10\/what-is-hsts-certificate.jpg","width":960,"height":621,"caption":"What is HSTS?"},{"@type":"BreadcrumbList","@id":"https:\/\/cheapsslweb.com\/resources\/what-is-hsts-certificate\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cheapsslweb.com\/resources\/"},{"@type":"ListItem","position":2,"name":"SSL and Encryption","item":"https:\/\/cheapsslweb.com\/resources\/ssl-and-encryption\/"},{"@type":"ListItem","position":3,"name":"What Is HSTS (HTTP Strict Transport Security)?"}]},{"@type":"WebSite","@id":"https:\/\/cheapsslweb.com\/resources\/#website","url":"https:\/\/cheapsslweb.com\/resources\/","name":"CheapSSLWeb.com","description":"SSL Errors and Installation Tutorials","publisher":{"@id":"https:\/\/cheapsslweb.com\/resources\/#organization"},"alternateName":"Cheap SSL Web","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cheapsslweb.com\/resources\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cheapsslweb.com\/resources\/#organization","name":"CheapSSLWeb","alternateName":"Cheap SSL Web","url":"https:\/\/cheapsslweb.com\/resources\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cheapsslweb.com\/resources\/#\/schema\/logo\/image\/","url":"https:\/\/cheapsslweb.com\/resources\/wp-content\/uploads\/2022\/03\/logo.png","contentUrl":"https:\/\/cheapsslweb.com\/resources\/wp-content\/uploads\/2022\/03\/logo.png","width":177,"height":60,"caption":"CheapSSLWeb"},"image":{"@id":"https:\/\/cheapsslweb.com\/resources\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cheapsslweb","https:\/\/x.com\/cheapsslweb","https:\/\/www.linkedin.com\/company\/cheapsslweb\/","https:\/\/www.pinterest.com\/cheapsslweb\/","https:\/\/www.instagram.com\/cheapsslweb\/"]},{"@type":"Person","@id":"https:\/\/cheapsslweb.com\/resources\/#\/schema\/person\/c7d26eacacd9392c23be9d82e9af145e","name":"Janki Mehta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","caption":"Janki Mehta"},"description":"Janki Mehta is a Cyber-Security Enthusiast having 7+ years of experience and knowledge about Encryption, Digital Certificates and Online Security, She helps online users to stay safe and protect their online presence. Explore SSL Errors, Installation Guide and Security Tutorials for Safe Browsing and Web Security Experience.","sameAs":["https:\/\/cheapsslweb.com\/","https:\/\/www.linkedin.com\/in\/pw-jankimehta\/"],"url":"https:\/\/cheapsslweb.com\/resources\/author\/janki-mehta\/"}]}},"_links":{"self":[{"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/posts\/390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/comments?post=390"}],"version-history":[{"count":20,"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/posts\/390\/revisions"}],"predecessor-version":[{"id":6519,"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/posts\/390\/revisions\/6519"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/media\/417"}],"wp:attachment":[{"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/media?parent=390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/categories?post=390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cheapsslweb.com\/resources\/wp-json\/wp\/v2\/tags?post=390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}