HTTP Strict Transport Security (HSTS) is an enhancement to the HTTP protocol that is designed to enforce strict security standards to help protect your site and users. HSTS does a number of things. Firstly, it ensures that all requests must be made via HTTPS. This ensures that data isn't accidentally sent via HTTP and, therefore, left unencrypted.
Secondly, it ensures that only a valid certificate can be accepted. In our previous examples, we used a self-signed certificate and the browser allowed us to bypass the security check. With HSTS enabled, this is no longer possible. This means that attempts to emulate your site or man-in-the-middle attacks where a different certificate is used are now no longer possible.
