8 ms·

It doesn't work if the user hasn't visited the site before because the HSTS header can be stripped just as easily.

• gtklocker 13y ago
  https://news.ycombinator.com/item?id=6978539 https://news.ycombinator.com/item?id=6978539
• lvh 13y ago
  The HSTS specification tells you not to put those headers in regular HTTP requests anyway. Also, you're forgetting about browsers that ship with lists of HSTS-enabled sites.