HSTS
HTTP Strict Transport Security lets a website inform the browser that it should never load the site using HTTP and should automatically convert all attempts to access the site using HTTP to HTTPS requests instead. It consists in one HTTP header, Strict-Transport-Security, sent by the server with the resource.
In other words, it tells the browser that changing the protocol from HTTP to HTTPS in a URL works (and is more secure) and asks the browser to do it for every request.
Example
The following header tells the browser to use HTTPS for 1 year (31536000 seconds) and include all subdomains:
http
Strict-Transport-Security: max-age=31536000; includeSubDomains
See also
Strict-Transport-Security- OWASP Article: HTTP Strict Transport Security
- Wikipedia: HTTP Strict Transport Security