Yes, for sites where the browser has an HSTS policy. OWASP says HSTS tells the browser to always request the site over HTTPS and prevents users from bypassing certificate warnings. It does not fix a bad certificate. It makes sure a bad one stops the visit instead of being clicked past.
What HSTS is
HTTP Strict Transport Security is a response header. The server sends it over HTTPS, and the browser remembers it for a set time. During that time the browser upgrades plain HTTP requests to HTTPS itself and treats certificate problems as hard failures.
Without it, a user who meets a certificate warning on a hostile network can usually press a button to proceed. That is the moment an attacker in the middle is waiting for.
What it protects and what it does not
| Threat | HSTS helps? |
|---|---|
| First request typed as http:// on a hostile network | After the first visit, yes |
| User clicks through a certificate warning | Yes, the bypass is blocked |
| Expired or misissued certificate on your server | No, the visit just fails |
| Weak TLS version or ciphers | No, configure TLS separately |
| A user's very first visit ever | Not unless the host is preloaded |
Preloading is a separate step with its own rules, so read the current browser preload documentation before relying on it.
How to roll it out safely
- Make sure every page and subdomain you will cover works over HTTPS.
- Fix certificate names. OWASP says the certificate name must match the fully qualified name of the server.
- Start with a short lifetime so a mistake can be undone.
- Watch error rates and support tickets for a week.
- Raise the lifetime in steps.
- Only then consider including subdomains, after you have listed every one.
- Automate certificate renewal. A hard failure plus an expired certificate is an outage with no workaround.
Why the last step matters
HSTS removes the escape hatch on purpose. If your certificate expires, users cannot click through. That is the right security outcome and a painful operational one, so renewal monitoring is part of the rollout, not an extra.
Pair it with a sound TLS setup
OWASP says web applications must default to TLS 1.3, and that TLS 1.0, 1.1, SSLv2 and SSLv3 must be disabled. Certificates should be signed by a trusted CA, use SHA-256 rather than MD5 or SHA-1, and use RSA keys of at least 2048 bits. See which TLS versions your app should support for the version policy.
Try it yourself
Open the web app scan demo and look at how response headers and transport settings are reported. Check whether your own site would show the HSTS header.
Click through it at your own pace, or open it full screen.
Safeguard can generate an SBOM and scan your dependencies, so outdated cryptography libraries with known advisories show up in one inventory, and policies can gate a build on them. A free scan is at gold.safeguard.sh/scan.
Quick check
Can HSTS break a site?
Yes, if a covered host cannot serve valid HTTPS, browsers will refuse it. Test and monitor before extending the lifetime.
Do APIs need HSTS?
It targets browsers. For non browser clients, make sure they validate certificates and use HTTPS only.
Sources
Last reviewed: 19 October 2026.
