HTTPS and HSTS: why the padlock alone isn't enough

The little padlock in your browser means the connection between you and the website is encrypted. Nobody on the same Wi-Fi, no provider and no attacker in between can read along or alter the page. So far so good — but there's a gap.

The first request is often unprotected

When you type example.com, the browser frequently sends that first request unencrypted over http://. Only afterwards does the server redirect to the secure version. That brief window is exactly what an attacker can use to divert you to a fake site.

HSTS closes the gap

HSTS is an instruction from the server to the browser: "From now on you talk to me only encrypted — even if the user types http." The browser remembers this and won't even attempt an unencrypted request in future. The vulnerable first request disappears.

What matters

• Valid duration: HSTS only helps if a sufficiently long lifetime is set.
• Include subdomains: With includeSubDomains the protection covers every sub-page too.
• Preloading: Optionally the domain can be added to a list browsers ship with — then even the very first visit is protected.

In short: HTTPS is the encryption, HSTS is the guarantee that it's always used. Only together do they form dependable protection.