This question already has an answer here:

What do you think would happen if someone accesses a site that has the HTST mechanism enabled, for the first time? Would SSL Stripping still be possible?

marked as duplicate by WhiteWinterWolf, Rory Alsop Jan 18 '16 at 11:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Some browsers includes a mechanism named "HSTS preload", which consists of a list of sites which uses HSTS to avoid this "first-access" attack.

Google made a website which can be used to request the insertion of your website in those lists.

Not the answer you're looking for? Browse other questions tagged or ask your own question.