301 Redirect and HSTS in .htaccess

Question

I\'ve changed a site to https and have set up a redirect in .htaccess. But I\'ve also set Strict Transport Security. Are both necessary or useful?

Answer 1

Yes! You should keep both of them. From OWASP docs, there're many benifits to use HSTS. E.g:

• automatically redirects HTTP requests to HTTPS.

• prevent user from overridding invalid certificate message.