HTTP Strict Transport Security (HSTS).

HSTS, defined in RFC 6797, is signalled by the Strict-Transport-Security response header. Once a compliant browser receives this header over HTTPS, it remembers the policy for the declared max-age and automatically upgrades any future request to that host (and optionally its subdomains) to HTTPS, refusing to connect if the TLS handshake or certificate validation fails. This neutralises SSL-stripping attacks (Moxie Marlinspike's 2009 sslstrip) and cookie injection over plaintext.

HSTS has one structural weakness: trust-on-first-use. Before a browser has ever seen the header, the very first request can still be intercepted and downgraded. The preload list — a hard-coded set compiled into Chromium, Firefox, Safari and Edge — closes that gap by shipping the policy with the browser, so even the first visit is forced to HTTPS. Submission requires max-age of at least 31536000 (one year), includeSubDomains, and the preload directive, via hstspreload.org. Google Registry preloaded entire gTLDs such as .dev and .app, meaning every domain under them is HTTPS-only by default. Caveat: removal from the preload list propagates slowly, so preload only when you can commit to HTTPS-everywhere long term.

flowchart TD
  A[Browser first visit] -->|no policy yet| B{On preload list?}
  B -->|yes| C[Force HTTPS immediately]
  B -->|no| D[Plaintext request possible - TOFU risk]
  D --> E[Server sends Strict-Transport-Security header]
  E --> F[Browser caches policy for max-age]
  F --> G[All future requests auto-upgraded to HTTPS]
  G -->|invalid cert| H[Hard-fail, no click-through]