HTTPS
HTTP over TLS, encrypting traffic between browser and server; a lightweight Google ranking signal since 2014 and a baseline expectation…
TechnicalHTTP Strict Transport Security
HSTS
A response header instructing browsers to only contact a host over HTTPS for a set period, eliminating the initial insecure request.
In full
`Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` tells browsers to upgrade http URLs internally, which shows as a 307 internal redirect rather than a network round trip. Domains can be submitted to a browser preload list so the policy applies even on first visit. HSTS applies to browsers, not crawlers, so server-side 301s from http to https are still required for search engines.
Example
After enabling HSTS with preload, http requests never leave the browser, cutting one redirect hop from TTFB for returning users.
Related terms
307 redirect
A temporary redirect that, unlike 302, guarantees the HTTP method and body are preserved; also the code browsers report for internal HSTS…
Time to First Byte
The interval between a navigation request starting and the first byte of the response arriving; a foundational input to LCP and a signal…
Mixed content
Insecure http subresources loaded by an https page; browsers block active mixed content and may upgrade or block passive content.
Redirect chain
A sequence of two or more redirects between the requested URL and the final destination; each hop adds latency and risks signals being lost.