HTTP Strict Transport Security (RFC 6797)

1. Overview

   Threat model and HSTS policy mechanism.

2. Strict-Transport-Security header

   max-age, includeSubDomains and preload directives.

3. Server processing model

   When servers send STS headers and how they redirect.

4. User agent processing model

   Known HSTS host handling and upgrading.

5. Security considerations

   Bootstrap MITM and denial of service considerations.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.