The HTTP Strict Transport Security (HSTS) header allows a host to enforce the use of HTTPS on the client side. By informing the browser to only use HTTPS, even if the user specifies HTTP as the protocol, the browser will enforce the use of HTTPS. This protects the user from various forms of SSL stripping attacks and provides the host an option to better enforce the use of secure communications.

HSTS, coupled with server side redirection from HTTP to HTTPS, offers a more robust implementation of SSL as the browser is now aware that you expect secure comms. If a Man In the Middle tries to strip out SSL from your communications by acting as a proxy, your browser will refuse the connection because it is expecting HTTPS and not HTTP.

Setting up HSTS in Apache

Setting up HSTS in Nginx

Setting up HSTS in PHP

Clear HSTS settings in Major Browsers

• https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet
• https://hstspreload.appspot.com/