HTTP Strct Trnsprt Scrty (HSTS) s plcy mchnsm tht hlps t prtct wbsts gnst mn-n-th-mddl ttcks sch s prtcl dwngrd ttcks nd ck hjckng. t llws wb srvrs t dclr tht wb brwsrs (r thr cmplyng sr gnts) shld tmtclly ntrct wth t sng nly HTTPS cnnctns, whch prvd Trnsprt Lyr Scrty (TLS/SSL), nlk th nscr HTTP sd ln. HSTS s n TF stndrds trck prtcl nd s spcfd n RFC 6797.
Th HSTS Plcy s cmmnctd by th srvr t th sr gnt v n HTTP rspns hdr fld nmd Strct-Trnsprt-Scrty. HSTS Plcy spcfs prd f tm drng whch th sr gnt shld nly ccss th srvr n scr fshn.: §5.2 Wbsts sng HSTS ftn d nt ccpt clr txt HTTP, thr by rjctng cnnctns vr HTTP r systmtclly rdrctng srs t HTTPS (thgh ths s nt rqrd by th spcfctn). Th cnsqnc f ths s tht sr-gnt nt cpbl f dng TLS wll nt b bl t cnnct t th st.
Th prtctn nly ppls ftr sr hs vstd th st t lst nc, rlyng n th prncpl f "trst n frst s". Th wy ths prtctn wrks s tht whn sr ntrng r slctng n HTTP (nt HTTPS) RL t th st, th clnt, sch s Wb brwsr, wll tmtclly pgrd t HTTPS wtht mkng n HTTP rqst, thrby prvntng ny HTTP mn-n-th-mddl ttck frm ccrrng.