How does HSTS prevent SSL stripping attacks?

HSTS is a rule the browser learns from a valid HTTPS response. After receiving Strict-Transport-Security: max-age=300, it remembers the host and upgrades later http:// requests to HTTPS before connecting. It also refuses to bypass certificate errors. That prevents an on-path attacker from stripping an HTTP-to-HTTPS redirect once the browser knows the rule.

Start with a short max-age on HTTPS responses and increase it after checking the site. Add includeSubDomains only when every subdomain, including internal hosts, supports HTTPS. Keep the HTTP-to-HTTPS redirect, but do not rely on an HSTS header sent over HTTP—browsers ignore it.

The first visit is the important gap: a browser that has not learned the policy may still make an initial HTTP request. Preloading can close that gap, but adding preload to the header alone does not put a domain in browser lists. Submission requires a valid certificate, HTTPS across subdomains, an HTTP-to-HTTPS redirect where applicable, and a base-domain header with at least one year of max-age, includeSubDomains, and preload. Removal can take months, so preload should not be a quick scanner fix. Sources: MDN HSTS reference and HSTS preload requirements.