Security Tip: HSTS — Force HTTPS So Nobody Downgrades Your Visitors

You installed an SSL certificate, your site loads over HTTPS, and the padlock shows. That should be the end of the story — but it isn't. The first time a visitor types your domain, their browser still starts with plain HTTP, and an attacker sitting on the same network can intercept that first request and keep the visitor on an insecure connection. This is called an SSL stripping attack, and your certificate does nothing to stop it.

HTTP Strict Transport Security, or HSTS, closes that gap. It is a single response header — Strict-Transport-Security — that tells browsers to only ever connect to your site over HTTPS, for a period you set. Once a browser has seen the header, it will refuse to load your site over HTTP at all, even if the visitor types http:// or clicks an old insecure link. The downgrade attack simply stops working.

Setting it up takes minutes. Most hosts and security plugins can add the header for you, or you can add it in your server configuration with a max-age of at least six months (31536000 seconds), plus includeSubDomains so every subdomain is covered too. Two warnings before you switch it on: make sure every part of your site genuinely works over HTTPS first, including images and scripts, because HSTS will block mixed content outright. And only add the preload flag once you are certain, since getting removed from the browser preload list is a slow process.

A certificate encrypts the connection. HSTS makes sure the connection is always encrypted. Run a free check of your site's exposure at https://vulnerabilitytools.com/ and make HSTS part of your hardening routine, alongside updates, backups and scans.