What is HSTS?
HSTS, short for HTTP Strict Transport Security, is a security policy a website sends to a browser in a response header. Once the browser has seen it, that browser refuses to talk to the site over plain HTTP for a set time: it silently upgrades every request to HTTPS and will not let the user click past a certificate error. The standard is defined in RFC 6797. Its purpose is to close the small window at the start of a visit when a connection can still be downgraded to no encryption.
How the header works
The server sends the policy on an HTTPS response, with three parts a candidate should recognize: max-age gives the lifetime in seconds, so the rule persists on later visits; includeSubDomains extends it to every subdomain; and preload opts the domain into a list browsers ship with. A full policy looks like Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. The browser stores the rule and enforces it on its own, before any request leaves the machine.
The problem it solves
When someone types a bare domain, the first request often goes out over HTTP, and the server answers with a redirect to HTTPS. An attacker sitting on the path, such as on untrusted Wi-Fi, can intercept that first request and keep the victim on HTTP while talking to the real site over HTTPS, a trick called SSL stripping. The victim sees no padlock and no certificate warning. HSTS defeats this because the browser upgrades to HTTPS before sending anything, so the attacker never gets a plain HTTP request to seize.
The first-visit gap and the preload list
HSTS has one weakness: a browser that has never visited a domain has not yet received the header, so the very first request can still be stripped. The preload list answers that. Browser makers maintain a built-in set of domains that must always use HTTPS, and a site owner can submit a domain once the whole site runs on HTTPS and the header carries preload, includeSubDomains and a max-age of at least one year, so protection applies even on a first visit.
HSTS on the CompTIA Security+ exam
HSTS appears as the fix for SSL stripping, which is taught with downgrade attacks under SY0-801 objective 2.5. A scenario where a login page loads as plain HTTP although the server already redirects to HTTPS, or where no padlock shows on public Wi-Fi, points to stripping, and the control that stops it for both returning and first-time visitors is HSTS with preloading. Weaker answers include disabling old TLS versions, which does nothing when no TLS reaches the user, or adding a stronger cipher suite.