HSTS

Enforce HTTPS with HSTS

TLS protects an HTTP connection after the browser starts HTTPS. A plain HTTP request sent before a redirect is different: it has no TLS protection, so a network attacker can alter the response and prevent the redirect from reaching the browser. HTTP Strict Transport Security (HSTS) gives a site a browser-enforced transport rule. After receiving a valid HSTS policy over HTTPS, a supporting browser remembers that the host must use HTTPS for a defined period. Future HTTP navigation attempts are upgraded locally before an insecure request is sent.