What is HSTS and how can it be activated?

HSTS (HTTP Strict Transport Security) is a web security mechanism that helps protect websites against "downgrade protocol" and "cookie hijacking" attacks. By using HSTS, the web server informs web browsers that on sites where this mechanism is enabled, the connection must occur only through HTTPS and never through HTTP, with requests made via HTTP being ignored.

Because when a web client first connects to a site, it does not yet know whether the connection will occur via HTTP or HTTPS and waits for instructions from the web server, there is still the possibility of interception of communications. To eliminate this risk, after activating HSTS, the domain can be included in the "preload" list. Thus, the domain name will be entered in the web browser as operating only on HTTPS.

Attention: After being added to the "pre-loading" list, the website will no longer function on HTTP, but only on HTTPS.

More details regarding the "preloading" lists and adding or removing a domain from these lists can be read by visiting: https://hstspreload.org/.

Example of HSTS implementation in the .htaccess file of the Apache web server:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"