https://nalar.dev/tags/hsts/ Recent content in HSTS on Nalar Hugo en-us Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/enforce-https-with-hsts/ Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/enforce-https-with-hsts/ <p>TLS protects an HTTP connection after the browser starts HTTPS. A plain HTTP request sent before a redirect is different: it has no TLS protection, so a network attacker can alter the response and prevent the redirect from reaching the browser.</p> <p>HTTP Strict Transport Security (HSTS) gives a site a browser-enforced transport rule. After receiving a valid HSTS policy over HTTPS, a supporting browser remembers that the host must use HTTPS for a defined period. Future HTTP navigation attempts are upgraded locally before an insecure request is sent.</p>