4
votes
1answer
669 views

Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?

Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...