Of course it is detected, we are not trying to fool the PC. When I visit my personal website with a flawed certificate (for example, once I was missing the Inte

Of course it is detected, we are not trying to fool the PC. When I visit my personal website with a flawed certificate (for example, once I was missing the Intermediate CA) it loads the site all the same, but the lock icon shows a security verification failure. What in HSTS protects you from that? Because it seems to me if you can get there, you can get back to http:// http:// before the user notices the verification failure. Unless the browser simply refuses to load the site due to the verification failure, which I only see for "suspected attack sites" Intercept 443 => Issue insecure page with new HSTS timeout => Redirect to 80 before user notices insecure page warning