Web Security · Junior · Question 11 of 75

What does the `Strict-Transport-Security` (HSTS) header do?

1Blocks the site from loading inside iframes
2Encrypts cookies with a stronger algorithm
✓Correct answer: Tells the browser to use only HTTPS for this site for a set time, even if the user types http://

Explanation

With HSTS the browser rewrites http:// to https:// before sending anything, which closes the window for SSL stripping attacks on later visits.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.