What is HSTS and why does it protect HTTPS connections?
Published on 2026-10-26 by frfrand
HSTS explained: how it forces the browser to use HTTPS, configuration risks, and when it makes sense to enable preload.
HSTS (HTTP Strict Transport Security) is a policy that tells the browser it must connect to a domain via HTTPS for a defined period. It serves to reduce the risk of someone forcing an insecure HTTP connection after the browser has received the policy.
A simple way to understand it
Imagine you visit a bank and an employee reminds you that you should only enter through a guarded door. When you return, your browser applies that rule without waiting for the server to redirect you again. HSTS stores a security preference for the domain; it does not create the certificate nor replace TLS.
How it works in practice
The HTTPS server sends a header such as Strict-Transport-Security: max-age=31536000. The compatible browser remembers the policy for that period. Optionally it can include includeSubDomains and there is a preload list mechanism. These are distinct decisions with real consequences: affecting subdomains or entering a preload list requires planning.
What it does not solve and its limits
An initial HTTP connection, before knowing the policy, can carry certain risks; preload seeks to reduce this problem for included domains. HSTS does not prevent the user from delivering data to a fake domain with HTTPS nor fix a vulnerable application. If your certificate expires or a subdomain does not support HTTPS, an overly aggressive policy can prevent access. Do not enable includeSubDomains without inventorying all applications.
How to apply it and check it without surprises
First check that the domain and affected subdomains work correctly with HTTPS. Verify that redirects and certificates are valid; apply an initially shorter duration if you need to evaluate behavior before extending it. Remember that removing the header on the server does not immediately erase policies already stored in browsers.
How does it appear in ArduMaker?
In an application hosted on an ArduMaker VPS you can configure this header via Nginx or the corresponding web server, provided you have HTTPS correctly operational. It is a complementary measure, not a replacement for managing certificates.
An example of responsible configuration
Before enabling HSTS on a domain that contains several subdomains, inventory old services, administration tools, and test servers. A subapplication may not yet have valid certificates. Verify that all critical paths work over HTTPS from a clean browser. If you plan to request preload, read its official conditions: reverting an inclusion can be slow. Record who changed the policy and how it will be verified during certificate renewals.
What to observe when something fails?
If a visitor cannot open a site due to a certificate error, investigate the domain name, the certificate chain, and the expiration date. Do not ask them to disable warnings to enter. That shortcut hides the problem and can reduce security.
To remember
HSTS (HTTP Strict Transport Security) is a policy that tells the browser it must connect to a domain via HTTPS for a defined period. Understanding when it applies, how it fails, and what data to review is more useful than memorizing isolated commands.
To expand: MDN: Strict-Transport-Security.