What is HTTP Strict Transport Security?

HTTP Strict Transport Security is a response header instructing the browser to contact a site only over HTTPS for a stated period, preventing downgrade to plain HTTP. It is defined in RFC 6797.

Primary sources

Specifications cited by the tools below whose own titles define HTTP Strict Transport Security.

RFC 6797 — HTTP Strict Transport SecurityIETF

2 tools that work with HTTP Strict Transport Security

Files never leave your browser.

Developer Tools1

HTTP Security Header AnalyserPaste response headers and get a security grade, with what is missing and why it matters.

Network Tools1

HTTP Header CheckerFollow every redirect, grade the security headers and read the cookie and caching settings.

Related terms

Terms that appear alongside HTTP Strict Transport Security on the same tools.

Content Security Policy
OWASP
URL redirection

← All glossary terms Browse every tool →