Why must a HSTS header not be sent on HTTP?

What would it hurt; clients could take it as a hint to redirect to https.


1 Answer 1


HTTP requests can be manipulated by third parties (mitigating this is one of the main purposes of HTTPS). What happens if a third party modifies a HTTP response to add a HSTS header? Imagine that this happens to a site which does not support HTTPS. The client now attempts to access the site over HTTPS, which is not supported. Voilà: the third party has completely blocked access to the site (and for quite some time, if it was a long-term HSTS header).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.