What is HSTS and does my small business website need it?

HSTS (HTTP Strict Transport Security) is a header that tells browsers to only ever connect to your site over an encrypted connection - and to refuse to try the unencrypted version, even when a user types the address without https or clicks an old http link:

• Without it - that first unencrypted request is an opening: on hostile networks it can be intercepted and the visitor silently kept on an attacker-controlled connection.
• With HSTS - the browser remembers your site is HTTPS-only for as long as the header specifies and closes that window itself.
• If your site already redirects to HTTPS - HSTS is the one-line follow-through that makes the redirect trustworthy.

7 in 10 Australian small business websites do not send an HSTS header^*. Set it once your HTTPS works everywhere - including subdomains - because the browser will hold you to it.