HTTPS

Enforce HTTPS with HTTP Strict Transport Security

TLS protects an HTTP connection after the browser has chosen HTTPS and completed certificate validation. A separate problem exists before that protected connection begins: a user can type a bare hostname, follow an old HTTP link, or reach a page that redirects from HTTP to HTTPS. HTTP Strict Transport Security, usually called HSTS, lets a site tell supporting browsers to treat future connections to that host as HTTPS-only. The browser stores the policy for a defined period. While the policy is active, an HTTP navigation is upgraded locally before an insecure HTTP request is sent.