HSTS isn't a protocol, it bascailly a flag that tells a browser to only use TLS to connect to a specfic domain. It normally does require one successful connecti

HSTS isn't a protocol, it bascailly a flag that tells a browser to only use TLS to connect to a specfic domain. It normally does require one successful connection for the server to tell it, but both chrome [0] and firefox [1] have a list of sites built-in so that even the first time they connect they'd be TLS. [0] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr... [1] https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...