jonathantneal/wget.sh — pull request #3 by mathiasbynens (2013-10-25 08:13:58+00:00)
Title: Enable HTTP Strict Transport Security (HSTS)

This causes web browsers (but not tools like `curl`) to interact with `wget.sh` using only secure HTTPS connections.

1. If `http://wget.sh/` (note: HTTP) is visited, it redirects to `https://wget.sh/` (this is nothing new).
2. As soon as a web browser detects the `Strict-Transport-Security` header on the HTTPS version of the page, it will remember this for the amount of seconds specified (31556900 seconds → 1 year, more or less).
3. From now on, whenever the user enters `http://wget.sh/` in his address bar, it won’t even make the unsafe request over HTTP — the browser will do the redirect for you. This way, you’re not browsing over HTTP at any point, and MitM attacks are prevented.

Related to #1.