3 ms·

It's necessary for HTTP requests. Are you being deliberately obtuse?

• ars_technician 13y ago
  It doesn't work if the user hasn't visited the site before because the HSTS header can be stripped just as easily.
  • gtklocker 13y ago
    https://news.ycombinator.com/item?id=6978539 https://news.ycombinator.com/item?id=6978539
  • lvh 13y ago
    The HSTS specification tells you not to put those headers in regular HTTP requests anyway. Also, you're forgetting about browsers that ship with lists of HSTS-enabled sites.