- http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
- http://tools.ietf.org/html/rfc6797
- https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
- https://hstspreload.appspot.com
HSTS stands for HTTP Strict Transport Security. It defines an HTTP header read while using HTTPS schemes (ignored in plain-text HTTP), that instructs the browser to prefer using an encrypted HTTPS over HTTP, helping protect against HTTPS downgrade attacks.
The following Apache configuration snippet requires mod_headers to be installed and loaded:
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS