HTTP Strict Transport Security (HSTS)

HTTP Strict Transport Security (HSTS)

If you run a website and have set up an SSL certificate for it, that is an important step toward security. But that alone is not enough. Even with HTTPS enabled, in some cases it is still possible to access the site via the old HTTP protocol – and this is exactly whereHSTScomes into play.

SSL and HTTPS: a brief reminder

An SSL certificate ensures that the connection between browser and server is encrypted. This prevents sensitive data such as passwords or user input from being transmitted unprotected. This type of encryption protects against attacks in which third parties attempt to intercept data during transmission – for example in public Wi-Fi networks or unfamiliar networks.

The problem: redirects alone are not enough

Many websites automatically redirect HTTP connections to HTTPS. This usually happens with a so-called 301 redirect. But before this redirect takes effect, the first contact with the website is unencrypted – and therefore theoretically vulnerable to attack. This security gap can be effectively closed with HSTS.

What exactly does HSTS do?

HSTS stands for HTTP Strict Transport Security. It is a security feature that tells the browser that a specific website may only be accessed via an encrypted HTTPS connection.

This is how it works:

1. The browser establishes a connection to the website via HTTPS.
2. The server responds and sends a special HSTS signal with it.
3. This signal tells the browser: “Please access this page only via HTTPS in the future.”
4. The browser stores this information for a specified period of time.
5. Every future visit to the page is automatically encrypted – even if the user accidentally types http://.

What about HSTS Preload?

Some browsers use so-called HSTS preload lists. These contain domains that may only be accessed via HTTPS from the outset – even before the first page load occurs. Anyone who has their domain added to such a list ensures maximum security from the very start.

When should HSTS be used?

HSTS is especially useful for:

• Websites with login areas or sensitive data
• E-commerce sites or customer portals
• Companies and organizations with high data protection requirements

In short: for any website where security matters.

How is HSTS activated?

HSTS is activated server-side by setting a special header. Depending on the server environment, this is done via the web server configuration or via a .htaccess file.

Requirements:

• The website must be fully accessible over HTTPS
• All content (images, scripts, stylesheets) must also be loaded over HTTPS
• Optional: entry in the HSTS preload list

Testing the HSTS header

You can test the activation of the HSTS header online with corresponding providers:

https://www.ssllabs.com/

Or do you prefer the purely technical route:

$ curl -s -D- https://example.com/|grep -i Strict

Have we piqued your interest?

You are welcome to contact us about this topic.

Write to us: info(at)e-pixler.com or call us: 030 220 5630 0

We are always here for you!