The HTTP `Strict-Transport-Security` response header ( abbreviated HSTS)
lets a web site tell browsers that it should only be accessed using
HTTPS, instead of using HTTP.

To exploit this vulnerability, an attacker must intercept and modify the
network traffic from the target.

This requires the client to communicate with the server over an insecure
connection such as public Wi-Fi.
