No more unencrypted fallback: How HSTS-Enforced makes secure browsing the standard

Every time you visit a website, your browser faces a split-second decision that can make or break your online safety. Modern browsers prefer to connect using HTTPS, the encrypted version of the web protocol that keeps your data private. However, if that encrypted connection fails, many browsers silently fall back to plain, unencrypted HTTP. This fallback, designed for compatibility, is a gift to attackers. Someone on the same network, say, a snooper on public Wi-Fi or a compromised home router, can block the HTTPS attempt, forcing your browser to use the unprotected HTTP version. From there, the attacker can read everything you send and even inject malicious content, without ever needing to crack any encryption.

This weakness has been known for over a decade, and the current fix relies on a mechanism called HTTP Strict Transport Security (HSTS). When you first visit a site that has HSTS enabled, it tells your browser, "Always connect to me securely from now on." Browsers also ship with a preloaded list of sites that only use HTTPS, protecting even the first visit. But these are still opt-in measures: website operators must actively enable HSTS or submit to the preload list. The underlying assumption remains that HTTP is the starting point, and security is an add-on.

A new proposal called HSTS-Enforced aims to flip that assumption entirely. Instead of websites having to opt into security, secure connections become the baseline. Under HSTS-Enforced, browsers would treat HTTPS as the default for all sites. A website that genuinely needs to use plain HTTP would have to signal that exception in a way that is cryptographically secure and tamper-proof, preventing attackers from faking such exceptions. This shift from an opt-in to an opt-out model would close the web’s “oldest backdoor”, the ability to silently downgrade your connection, without breaking the legitimate, if rare, use cases for unencrypted HTTP.

The road to adoption isn't trivial, as it requires careful handling of countless legacy systems and a new trust model for those exceptions. Yet the payoff is substantial: everyday users would no longer be at the mercy of a split-second browser choice they never see. While this standard evolves, there are steps you can take to protect yourself today. Using a browser’s HTTPS-Only mode, keeping software updated, and being mindful of network security all help. For an added layer of defense, using a private, encrypted DNS resolver like AEU DNS can lock down the domain name lookups that happen before any connection, making it harder for attackers to send you to a server that might try to downgrade your session in the first place.