HTTP Strict Transport Security (HSTS) is a web security policy delivered through the Strict-Transport-Security response header. When a browser receives it, the site tells the browser to use HTTPS only for future connections, even if the user types http:// or follows an insecure link.
HSTS matters because it helps stop protocol downgrade and SSL-stripping attacks, where an attacker tries to keep traffic on plain HTTP long enough to intercept or alter it. In defense, operators enable HSTS on login pages, admin portals, and other browser-facing services to enforce encryption and reduce accidental exposure. It is most effective when HTTPS is already correctly configured and paired with other controls such as secure cookies and a valid certificate chain.