4 ms·

I don't get this header. Wouldn't the man-in-the-middle that is using something like sslstrip also be able to strip out any header they choose to?

• daeken 13y ago
  Yes, this is the case, but only in the first request. As soon as an HTTP user agent gets such an HSTS header, it will only communicate via HTTPS until max-age expires.
  • davis_m 13y ago
    Only if the browser supports HSTS. Many do not, especially mobile browsers.