You type a web address without the “https” and the site loads securely anyway, every time, with no chance to land on an unencrypted version. Often the reason is HSTS, a quiet rule that tells your browser to refuse anything less than a secure connection. Our GetMyPassword team explains what HSTS is and why it protects you.
What HSTS is
HSTS (HTTP Strict Transport Security) is a setting a website uses to tell your browser, “always connect to me over HTTPS, never plain HTTP.” Once your browser has seen that instruction, it automatically upgrades every future visit to the secure version and refuses to load the site over an unencrypted connection. The rule is remembered for a set time, so the protection sticks rather than resetting on each visit.
The problem it solves
Without HSTS, your first connection often starts as insecure HTTP before redirecting to HTTPS — and that brief moment is a gap. An attacker on the same network can hijack that first request and keep you on a fake or downgraded connection, a trick called an SSL stripping attack. HSTS closes the gap by making the browser go straight to HTTPS from the start, so there is no insecure first step to intercept.
Why it matters to you
- Stronger protection on public Wi-Fi, where downgrade attacks are most likely.
- No accidental insecure version — the browser will not load the site over plain HTTP.
- Harder to spoof — it blocks a common way attackers slip between you and a site.
- It is automatic — once set by the site, you get the benefit with no effort.
HSTS turns “please use the secure version” into “only the secure version exists.” By removing the insecure first step, it removes the moment an attacker was waiting for.
What it does — and does not — cover
HSTS protects the connection to a site that uses it; it does not vet whether the site is trustworthy or guard your account once you log in. A phishing page on its own secure connection is still a phishing page, and a weak password is still weak over HTTPS. So enjoy the automatic protection, keep verifying you are on the real site, and secure the account itself with a unique password from our password generator and two-factor authentication.
Frequently asked questions
What is HSTS?
HTTP Strict Transport Security is a setting a website uses to tell your browser to always connect over HTTPS and never plain HTTP. The browser then upgrades every visit automatically and refuses insecure connections to that site.
How does HSTS protect me?
It removes the insecure first step where a connection starts as HTTP before redirecting, closing the gap used in SSL stripping and downgrade attacks. That is especially valuable on public Wi-Fi.
Does HSTS make a site completely safe?
No. HSTS secures the connection, but it does not prove a site is trustworthy or protect your account after login. You still need to confirm you are on the real site and use a strong, unique password with two-factor authentication.