That's correct, HSTS doesn't apply to IP literals. You can check with https://1.1.1.1/ https://1.1.1.1/. They would serve you an HSTS header: $ curl -sS -D-

That's correct, HSTS doesn't apply to IP literals. You can check with https://1.1.1.1/ https://1.1.1.1/. They would serve you an HSTS header: $ curl -sS -D- -o/dev/null https://1.1.1.1/ | grep -i strict-transport-security strict-transport-security: max-age=31536000 but you won't find 1.1.1.1 in chrome://net-internals/#hsts, and you can still directly request http://1.1.1.1/ http://1.1.1.1/, which returns a remote 301 response. Unlike for an HSTS domain, for which you get a local 307 response with a Non-Authoritative-Reason: HSTS header (in Chrome).