HTTP Strict Transport Security

HTTP Strict Transport Security: Web mechanism that compels browsers to use only encrypted HTTPS connections. The term is relevant to the assessment and design of modern security architecturesSecurity ArchitectureThe structured design of security controls, trust boundaries, data flows, and operational responsibilities. and should be applied within the specific technical and organizational context.

How it works and where it fits

HTTP Strict Transport Security is a preventive, detective, or corrective security control. Its effect depends on where it sits in the architecture, which data and decisions it processes, and how it might be bypassed. A control reduces a defined risk but rarely removes it completely, so it should be combined with additional layers of protection.

Practical security relevance

Before deployment, the objective, ownership, coverage, and expected behavior should be defined. Secure defaults, controlled exceptions, logging, and periodic effectiveness tests matter more than installation alone. Operational metrics should expose both blocked or detected activity and gaps, false alerts, and effects on legitimate business processes.

Related concepts

• Transport Layer SecurityTransport Layer SecurityProtects network connections through encryption, authentication, and integrity checks.: Protects network connections through encryption, authentication, and integrity checks.
• HTTPS InspectionHTTPS InspectionDecryption and inspection of encrypted web traffic by a controlling security entity.: Decryption and inspection of encrypted web traffic by a controlling security entity.
• Certificate PinningCertificate PinningSpecification of expected certificates or public keys for a connection.: Specification of expected certificates or public keys for a connection.
• Web Application FirewallWeb Application FirewallFilters HTTP traffic to protect web applications against common attacks.: Filters HTTP traffic to protect web applications against common attacks.