Why must a HSTS header not be sent on HTTP?

What would it hurt; clients could take it as a hint to redirect to https.


1 Answer 1


HTTP requests can be manipulated by third parties (mitigating this is one of the main purposes of HTTPS). What happens if a third party modifies a HTTP response to add a HSTS header? Imagine that this happens to a site which does not support HTTPS. The client now attempts to access the site over HTTPS, which is not supported. Voilà: the third party has completely blocked access to the site (and for quite some time, if it was a long-term HSTS header).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .