Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If you permanently redirect http to https, is the HSTS header still needed?


The HSTS header is valuable because it prevents all future requests from the client from ever going over HTTP.

So, for example, after visiting Hacker News once, the next time you type "news.ycombinator.com" into the URL bar, your browser will simply go directly to "https://news.ycombinator.com", rather than making the initial request to "http://news.ycombinator.com" as it usually would. This ensures that all future communications between the client and server are over a secure channel.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: