This question already has an answer here:
- HSTS extra security over HTTPS 2 answers
My website data is transferred via HTTPS. As far as I understand this, there is a certificate that is issued by CA which is provided by server for each client, client and server decide how to encrypt and decrypt the info being exchanged and from this point and on communicate only this way. This is basic HTTPS.
Now I do not understand where the Strict-Transport-Security header fits here. When the server sends it in response, the browser will conduct communication only via HTTPS. And in case some URLs are still HTTP it will automatically transform them to HTTPS.
Here is the question: if we've set up HTTPS like I've described in the first paragraph is it still necessary to send Strict-Transport-Security header with server response? If so, what purpose will it serve?