HTTP Strict Transport Security specification

E242258

HTTP header specification IETF standard web security standard

The HTTP Strict Transport Security specification is a web security standard that allows servers to enforce secure (HTTPS) connections by instructing browsers to refuse insecure HTTP access to a site.

Try in SPARQL Jump to: Surface forms Disambiguation Statements Elicitation Referenced by

All labels observed (6)

Label	Occurrences
HTTP Strict Transport Security	3
HSTS	2
HTTP Strict Transport Security (HSTS)	1
HTTP Strict Transport Security specification canonical	1
Strict-Transport-Security	1
Strict-Transport-Security header	1

How this entity was disambiguated

This entity first appeared as the object of triple T2187943 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.

NED1 Entity disambiguation (via context triple) gpt-5-mini-2025-08-07

Target entity: HTTP Strict Transport Security specification
Context triple: [HTTP Working Group, responsibleFor, HTTP Strict Transport Security specification]

A. RFC 7465 (prohibition in TLS)
RFC 7465 is an Internet standards document that formally prohibits the use of the RC4 stream cipher in Transport Layer Security (TLS) due to its significant cryptographic weaknesses.
B. RFC 6176 (prohibition of SSL 2.0)
RFC 6176 is an Internet Engineering Task Force (IETF) standard that formally deprecates and forbids the use of the insecure SSL 2.0 protocol in favor of more secure TLS versions.
C. SSL
SSL (Secure Sockets Layer) is a cryptographic protocol designed to provide secure, encrypted communication over a computer network, commonly used to protect data transmitted between clients and servers.
D. RFC 8446
RFC 8446 is the Internet standard that specifies TLS 1.3, a major revision of the Transport Layer Security protocol focused on improved security and performance for encrypted communications.
E. HTTPS Everywhere
HTTPS Everywhere is a browser extension that automatically enforces secure, encrypted HTTPS connections to websites to protect users’ privacy and security online.
F. None of above. chosen
G. Unsure - the case is ambiguous/there is not enough information to decide.

NED2 Entity disambiguation (via description) gpt-5-mini-2025-08-07

Target entity: HTTP Strict Transport Security specification
Target entity description: The HTTP Strict Transport Security specification is a web security standard that allows servers to enforce secure (HTTPS) connections by instructing browsers to refuse insecure HTTP access to a site.

A. RFC 7465 (prohibition in TLS)
RFC 7465 is an Internet standards document that formally prohibits the use of the RC4 stream cipher in Transport Layer Security (TLS) due to its significant cryptographic weaknesses.
B. RFC 6176 (prohibition of SSL 2.0)
RFC 6176 is an Internet Engineering Task Force (IETF) standard that formally deprecates and forbids the use of the insecure SSL 2.0 protocol in favor of more secure TLS versions.
C. SSL
SSL (Secure Sockets Layer) is a cryptographic protocol designed to provide secure, encrypted communication over a computer network, commonly used to protect data transmitted between clients and servers.
D. RFC 8446
RFC 8446 is the Internet standard that specifies TLS 1.3, a major revision of the Transport Layer Security protocol focused on improved security and performance for encrypted communications.
E. HTTPS Everywhere
HTTPS Everywhere is a browser extension that automatically enforces secure, encrypted HTTPS connections to websites to protect users’ privacy and security online.
F. None of above. chosen

Statements (43)

Predicate	Object
instanceOf	HTTP header specification ⓘ IETF standard ⓘ web security standard ⓘ
abbreviation	HSTS ⓘ linked to: HTTP Strict Transport Security specification
appliesTo	user agents supporting HSTS ⓘ web browsers ⓘ
appliesWhen	host is present in an HSTS preload list ⓘ user agent has seen a valid HSTS header for the host ⓘ
category	transport layer security mechanism ⓘ web application security control ⓘ
configurationLocation	server HTTP response headers ⓘ
definedByHeader	Strict-Transport-Security ⓘ linked to: HTTP Strict Transport Security specification
documentationURL	https://datatracker.ietf.org/doc/html/rfc6797 ⓘ
effect	forces HTTP requests to be rewritten to HTTPS by the browser ⓘ prevents users from bypassing certificate errors easily ⓘ reduces risk of man-in-the-middle attacks on first and subsequent connections ⓘ
firstPublicationYear	2012 ⓘ
fullName	HTTP Strict Transport Security ⓘ linked to: HTTP Strict Transport Security specification
influencedBy	earlier browser-specific HSTS implementations ⓘ
keyDirective	includeSubDomains ⓘ max-age ⓘ preload ⓘ
mechanism	instructs browsers to refuse insecure HTTP access ⓘ uses HTTP response header to signal policy to user agents ⓘ
policyType	client-enforced security policy ⓘ
primaryPurpose	enforce secure HTTPS connections ⓘ mitigate cookie hijacking over HTTP ⓘ mitigate protocol downgrade attacks ⓘ prevent use of insecure HTTP connections ⓘ
publishedBy	Internet Engineering Task Force ⓘ
relatedTo	HTTPS ⓘ TLS certificate validation ⓘ Transport Layer Security ⓘ linked to: TLS
requires	support from user agent ⓘ valid HTTPS configuration on the server ⓘ
scope	entire host ⓘ optionally subdomains ⓘ
securityProperty	helps ensure confidentiality and integrity of HTTP traffic ⓘ protects against SSL stripping attacks ⓘ
standardizedIn	RFC 6797 ⓘ
status	Proposed Standard ⓘ
usedBy	major web browsers ⓘ
usedFor	hardening website transport security ⓘ

How these facts were elicited