If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?

  • 3
    YES! If you don't enable HSTS, users must type in https:// manually, which hardly someone does. And, in some cases it may also be possible to connect directly through a specific port, bypassing HTTPS. Secure flag is a must, otherwise cookies that aren't secure will also be transmitted over HTTP request. Though it may not seem feasible at the moment, precaution is better than cure :D Jul 3, 2015 at 4:15

1 Answer 1


site is only available in HTTPS

HSTS in this case at least notifies that browser that the site will not be available in HTTP for the foreseeable future. Once the browser knows this (i.e. after the first visit) a downgrade attack like sslstrip will fail, because the browser will not connect with insecure HTTP to the site.

The secure flag for cookies will probably not provide any security benefit because it was already enforced that the site is available through HTTPS only. But it does not harm either and is a cheap feature so in the spirit of multilayered security (i.e. add another layer in case one gets broken) you better add it.

  • 1
    It is also a good idea to add the secure flag in the case of non host-only cookies. e.g. foo.example.com may be protected by HSTS which sets a cookie at .example.com level, however the attacker could read the cookie by setting up a plain HTTP connection to bar.example.com. An alternative is to also set includeSubDomains if all your subdomains are HTTPS. Jul 3, 2015 at 9:25
  • Wouldn't the secure flag also prevent interception of the cookie for the initial page view before being redirected to https, assuming the user hasn't visited the website before? Aug 17, 2016 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .