HTTP Strict Transport Security HSTS [How to Set Up]

Показать описание

HTTP Strict-Transport-Security response header (often abbreviated as HSTS) is a header that informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS.

In this video, we will cover the theory and the importance of the header, and how to check on the missing HTTP Strict-Transport-Security.

Why it's important

This method is more secure than simply configuring a HTTP to HTTPS (301) redirect on your server, where the initial HTTP connection is still vulnerable to a man-in-the-middle attack.

How to fix the issue
Add the following directive to HTTP header.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Get more info about this HTTP header in MDN Web Docs.

#hsts #hstscheck #checkHSTS