HSTS - A Trivial Response to sslstrip

This report explains **HTTP Strict Transport Security (HSTS)** (RFC 6797), its origins from ForceHTTPS, how it enforces HTTPS-only access via headers and preload lists, and why it matters for defending against passive/active network attacks and downgrade techniques like **sslstrip**. It details required header directives, deployment considerations (includeSubDomains, preload), and the first-visit weakness mitigated by preloading, while noting how attackers can still perform MitM if sites are misconfigured or not preloaded.