Have you ever tried to visit a site with http:// and watched your browser instantly switch it to https:// — with no way to load the insecure version, and sometimes no option to click past a security warning? That's HSTS at work. It's a small but powerful security feature that forces browsers to only ever connect securely to certain sites. Here's what HSTS is, why sites use it to force HTTPS, and the occasional errors it can cause — all in plain English.

What is HSTS?

HSTS stands for HTTP Strict Transport Security. It's a security policy a website can turn on that tells browsers: "Always connect to me over HTTPS — never plain HTTP, no exceptions."

Normally, if you type example.com, your browser might first try the insecure http:// version, which then redirects to the secure https://. That brief moment on HTTP is a small window an attacker could exploit. HSTS closes it: once your browser knows a site uses HSTS, it automatically upgrades every request to HTTPS before it's even sent, so the insecure version is never used at all.

How HSTS works

A site enables HSTS by sending a special response header (called Strict-Transport-Security) when you visit over HTTPS. That header tells your browser two main things: use HTTPS only for this site, and remember this rule for a set period of time (often a year).

From then on, your browser enforces it locally. Even if you type http:// or click an old insecure link, the browser silently rewrites it to https:// before connecting. The rule refreshes each time you visit, so an active site keeps the protection alive indefinitely. This all builds on the secure connection established by the site's SSL certificate and the HTTPS protocol.

Why do sites force HTTPS with HSTS?

Forcing HTTPS isn't a site being difficult — it's protecting you. The main reasons:

  • Preventing downgrade attacks. Without HSTS, an attacker on the same network can try to keep you on the insecure HTTP version to intercept your data. HSTS removes that option entirely.
  • Stopping cookie and session theft. Forcing HTTPS ensures login sessions and cookies are always encrypted, not exposed on an accidental HTTP request.
  • Guaranteeing consistency. Every connection is secure by default, with no reliance on redirects that could be tampered with.

For banks, shops, logins, and any site handling sensitive data, HSTS is a standard, sensible layer of protection.

The HSTS preload list

Sites can go a step further and join the HSTS preload list — a list built into browsers themselves. If a domain is preloaded, browsers enforce HTTPS-only from the very first visit, before the site has ever sent a header. This closes even the tiny gap on your first-ever connection to a site, and it's used by many major services for maximum security.

When HSTS causes errors

Because HSTS is strict by design, it occasionally causes confusion:

  • You can't bypass a certificate warning. On a normal site you can sometimes click "proceed anyway" past a certificate error. On an HSTS site, the browser won't let you — it blocks access entirely rather than risk an insecure connection. That's intentional, though it can be frustrating if the certificate genuinely expired. (Our guide on whether it's safe to bypass such warnings explains why this strictness is usually a good thing.)
  • An expired certificate becomes a hard outage. On an HSTS site, a lapsed certificate can't be clicked past by anyone, making a timely renewal even more critical — see our guide on avoiding an SSL expiry outage.
  • Mixed-content and redirect issues during an HTTP-to-HTTPS migration can be amplified by HSTS, so site owners enable it carefully after confirming HTTPS works everywhere.

If you hit one of these on a site you're trying to reach, it usually means the site's certificate has a real problem — not that you're doing anything wrong.

For site owners: should you enable HSTS?

If your site is fully on HTTPS, HSTS is a valuable security upgrade — but enable it deliberately:

  • Confirm HTTPS works everywhere first, including all subdomains, before turning it on.
  • Start with a short duration to test, then increase it once you're confident.
  • Keep your SSL certificate reliably renewed (ideally auto-renewed), because with HSTS active, an expired certificate locks everyone out. Verify your certificate anytime with our free SSL Certificate Checker.

Done right, HSTS gives your visitors guaranteed secure connections with no downside.

The bottom line

HSTS — HTTP Strict Transport Security — is a policy that forces browsers to connect to a site over HTTPS only, never insecure HTTP. It protects you from downgrade attacks and session theft by upgrading every request to secure automatically, and the preload list extends that protection to your very first visit. The trade-off is strictness: on an HSTS site you can't bypass certificate warnings, which makes a valid, unexpired certificate essential. For visitors, HSTS works silently in your favor; for site owners, it's a strong security win as long as your HTTPS setup is solid.