Skip to content
FrontendHaltFrontendHalt
Security·Intermediate·Conceptual·1 min read

What does Strict-Transport-Security (HSTS) protect against?

Short interview answer

It tells the browser to only ever connect to the origin over HTTPS for a set duration, preventing an attacker on the network from downgrading the first or a subsequent request to HTTP and intercepting it. The preload list extends this to the very first visit.

Key takeaway

Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.

← Back to Content Security Policy and security headers

Related questions