HTTP Strict Transport Security (HSTS)
PCIComplianceHubLast updated
A response header, Strict-Transport-Security, by which a site tells browsers to use HTTPS only for that host for a stated period, so that a later plain-HTTP link or typed address is upgraded before any request is sent, and a certificate error cannot be clicked through.
Applies to. Any host serving a payment page or the merchant page around one, and any provider host a browser is sent to. PCI DSS does not name it; it supports 4.2.1, strong cryptography for PAN in transit, by stopping the browser falling back to HTTP.
Example. A header of max-age=31536000 with includeSubDomains tells the browser that for a year every request to the host and its subdomains must be HTTPS. An interception on a public network that offers the site over plain HTTP never receives a request, because the browser rewrites the address to HTTPS before sending.
Limits. It takes effect only after a browser has seen the header once over a valid HTTPS connection, so the first visit is unprotected unless the domain is on the browser preload list. includeSubDomains breaks any subdomain that is not ready for HTTPS. HSTS says nothing about what the page then loads. It is commonly treated as one of the security-impacting response headers a change-detection mechanism under 11.6.1 records, since removing it prepares a downgrade.