What is HSTS, and what is the HSTS list?
I am a Site Reliability Engineer with nearly 5 years of experience. I talk about Linux, Automation, Networking, and anything else related to tech and CS.
HSTS stands for HTTP Strict Transport Security. When the browser finds the HSTS header in the server response, the HSTS basically asks the browser to access the website using HTTPS on port 443. And any future attempts to access the website should be made via HTTPS.
The HSTS Preload list is a centralized list maintained by Google, of which every browser usually maintains a local copy that is regularly updated. The websites need to submit to Google to get added to the HSTS preload list. The recommended max-age is two years if the preload directive is also being used.
HSTS is particularly important as it forces HTTPS. It also helps save clients from MITM attacks. There are still scenarios when HSTS fails to protect from MITM, but to avoid that, don't connect to WIFIs you don't know or trust.
