# Strict-Transport-Security (HSTS)

> Strict-Transport-Security (HSTS) is an HTTP header that tells browsers to use a website only over HTTPS for a set time, even when someone types or links http://.

- **Check ID:** SEC2
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/strict-transport-security-hsts

## Why it matters

Without HSTS, the first visit over HTTP is vulnerable to SSL stripping attacks: an attacker can intercept the redirect to HTTPS and eavesdrop on the communication. With HSTS, the browser automatically upgrades to HTTPS before even sending the request.

## In practice

GitHub.com sends the header Strict-Transport-Security: max-age=31536000; includeSubdomains; preload. Thanks to this, the domain github.com is included in the HSTS preload list, so the browser never sends an HTTP request even on the first visit.

## How be1st checks it

Checks for the presence of the Strict-Transport-Security HTTP header with a max-age value of at least 31536000 (1 year). Full points require a max-age of at least 1 year plus the includeSubDomains directive. HSTS instructs the browser to automatically send all future requests to the domain over HTTPS, even if the user types http://.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [Strict-Transport-Security header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security) (MDN)
- [HTTP Strict Transport Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html) (OWASP)

## Related terms

- [HTTPS (security)](https://be1st.ai/glossary/security/https): HTTPS is HTTP encrypted with TLS. It keeps passwords, forms and cookies private on the way between the visitor and the server.
- [Content-Security-Policy (CSP)](https://be1st.ai/glossary/security/content-security-policy-csp): Content-Security-Policy (CSP) is an HTTP header that lists the sources a page may load scripts, styles, images and frames from. It is the main defence against XSS.
- [X-Frame-Options](https://be1st.ai/glossary/security/x-frame-options): X-Frame-Options is an HTTP header that decides whether other websites may embed your page in a frame. It protects visitors against clickjacking.
- [X-Content-Type-Options](https://be1st.ai/glossary/security/x-content-type-options): X-Content-Type-Options: nosniff is an HTTP header that stops browsers from guessing a file's type, so a file cannot run as something it was not sent as.
- [Referrer-Policy](https://be1st.ai/glossary/security/referrer-policy): Referrer-Policy is an HTTP header that controls how much of the current URL the browser sends to other sites when a visitor follows a link or a resource loads.
- [Permissions-Policy](https://be1st.ai/glossary/security/permissions-policy): Permissions-Policy is an HTTP header that turns browser features such as the camera, microphone or geolocation on or off for a page and its frames.