Glossary · Web tech

HSTS

Also calledhttp strict transport security

Definition

HTTP Strict Transport Security (HSTS) tells browsers to only connect to a site over HTTPS, preventing plaintext-HTTP downgrade attacks.

Explanation

In depth

When a browser visits an HSTS-enabled site for the first time, the server sends an HSTS header that the browser remembers for a specified duration (often a year). During that window, the browser refuses to connect to that site over plain HTTP — it either upgrades to HTTPS or shows an error. HSTS Preload takes this further: browsers ship with a hardcoded list of HSTS-enabled sites (anyproxy.site is on that list) so even the first connection is HTTPS-only. HSTS defeats a class of downgrade attacks where a MITM strips the initial HTTP redirect to HTTPS. It does not defeat SNI-based blocking or DPI, but it does close a real attack path.

Related terms

TLS handshakeThe TLS handshake is the initial exchange between client and server that agrees on encryption keys and verifies the server's identity before any application data flows.HTTPS proxyAn HTTPS proxy is an HTTP proxy that supports the CONNECT method for tunneling encrypted HTTPS traffic to any destination.MITM (Man-in-the-Middle)A man-in-the-middle intercepts traffic between two parties — reading, modifying, or blocking the communication without either endpoint knowing.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page