What is HSTS?

Short answer

HSTS (HTTP Strict Transport Security) is the mechanism by which the server, with the Strict-Transport-Security header it adds to the HTTPS response, tells the browser to connect to that domain only with HTTPS for the max-age period; within this period, the browser converts http:// addresses to HTTPS without first sending a request and does not allow a certificate error to be bypassed. includeSubDomains extends the rule to subdomains, and preload is the flag required for submitting the domain to the browsers' preload list. In TR7, HSTS is added to HTTP vService responses with the HSTS (Strict-Transport-Security header) setting in the TLS Security Profile or with the Manage HTTP Security Headers action.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → TLS Security Profiles → Frontend-only Settings	HSTS (Strict-Transport-Security header) (off by default), HSTS Duration (max-age) (default 180 days), Include Subdomains (includeSubDomains), Browser Preload List Flag (preload)	An HSTS header whose duration and directives can be set; the profile is selected in the SSL Security field of the HTTP vService
Load Balancer → Actions (Policy Actions) → Manage HTTP Security Headers	Strict-Transport-Security (HSTS)	An HSTS header with a fixed value (max-age=16000000; includeSubDomains; preload;)

Common Misconceptions

• "HSTS replaces the redirect from HTTP to HTTPS." The browser learns the header only once it receives the first HTTPS response; the redirect is still needed for the first visit (How do I redirect HTTP to HTTPS?).
• "HSTS is easily undone." The browser remembers the rule for the max-age period; for a domain that has entered the preload list, removal from the list takes even longer (RFC 6797).
• "The preload flag can be added with any duration." For preload, the TR7 form requires a max-age of at least 1 year and Include Subdomains; otherwise, it gives the preload requires a max-age of at least 1 year and includeSubDomains error.
• "The profile and the action together produce two headers." If the vService also has the action, the action's value takes effect; HSTS is managed from a single place (How do I add HSTS?).

How it is done in the documentation

• TLS Security Profiles · HSTS (Strict-Transport-Security header)
• Manage HTTP Security Headers · The Security Headers That Can Be Selected

Related questions

• How do I add HSTS?
• Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?
• What are HTTP security headers?
• What is the difference between HTTP and HTTPS?