HSTS
HSTS is an instruction a website gives your browser: from the first visit on, connect to it only over encrypted HTTPS, never over plain http.
What is HSTS?
HSTS stands for HTTP Strict Transport Security. It is a piece of information a website sends to your browser, specifically a header called Strict-Transport-Security. It tells the browser: from now on, only open me over encrypted HTTPS. For a period set by the site’s operator, the page is then no longer loaded over unencrypted http://, even if you type it that way or an old link points to it.
How it works and why it matters
Even when a site offers HTTPS, the very first request often starts unencrypted, for example when you type just the name without https://. The site then usually redirects to HTTPS, but that first step can be intercepted or redirected on untrusted networks such as open Wi-Fi. HSTS closes this gap: after the first visit the browser remembers the rule and switches to HTTPS by itself, without asking first.
What to keep in mind
HSTS only takes effect after the first successful visit, and only for the period the operator has specified. It ensures an encrypted connection to the website, but says nothing about whether the site itself can be trusted: fraudulent sites can use HTTPS too. So keep checking the address and be careful with links in messages, because HSTS does not stop phishing. If your browser shows a certificate warning on an HSTS site, it usually cannot simply be clicked away – that is intentional.
On Friendstime
friendsti.me sends the HSTS header, Strict-Transport-Security, with a validity of two years, including all subdomains. If you open friendsti.me via http://, you are redirected to https://. As a result, the connection to Friendstime is always encrypted (TLS) after your first visit, even if you type http:// or follow an old link.
Frequently asked questions
What is the difference between HTTPS and HSTS?
HTTPS is the encrypted connection itself. HSTS is the instruction to the browser to open a website only over HTTPS in future. So HSTS does not replace HTTPS; it makes sure HTTPS is actually used.
Does HSTS apply to Friendstime?
Yes. friendsti.me sends the HSTS header with a validity of two years, including all subdomains, and redirects requests made via http:// to https://. After your first visit, the connection is therefore always encrypted (TLS).
Does HSTS protect me from phishing?
No. HSTS only ensures an encrypted connection to the website in question. A fake site can still use HTTPS. So check the address and be careful with links in messages.
Related terms
Related topics
Try Friendstime
Signing up takes a minute and is free.