So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are you still vulnerable? Can an attacker intercept your HTTPS request and perform the request "on your behalf", so-to-speak, and serve your browser an HTTP version, if you type into your browser's address bar? (Using either SSLStrip or some other attack?)
Below user10008 gives the answer. SSLStrip doesn't depend on the server's behavior, it depends on the client. If you can get the client to make the request over HTTP, instead of HTTPS, you can perform the attack, even if the server only supports HTTPS. HSTS prevents the browser from performing the plain HTTP request in the first place (on subsequent requests).