title: "RESPONSE_Strict_Transport_Security" server variable for forcing SSL in IIS
body: <p>So, I've seen this solution (<a href="http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx" rel="noreferrer">http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx</a>) used in other answers and other sites, but I don't understand HOW the HSTS header is being added. I assume it has a lot to do with this: </p>
  
  <pre><code>&lt;match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" /&gt;
  </code></pre>
  
  <p>Could someone explain where "RESPONSE_Strict_Transport_Security" is coming from?</p>
  
  <p>Full code:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;configuration&gt;
      &lt;system.webServer&gt;
          &lt;rewrite&gt;
              &lt;rules&gt;
                  &lt;rule name="HTTP to HTTPS redirect" stopProcessing="true"&gt;
                      &lt;match url="(.*)" /&gt;
                      &lt;conditions&gt;
                          &lt;add input="{HTTPS}" pattern="off" ignoreCase="true" /&gt;
                      &lt;/conditions&gt;
                      &lt;action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                          redirectType="Permanent" /&gt;
                  &lt;/rule&gt;
              &lt;/rules&gt;
              &lt;outboundRules&gt;
                  &lt;rule name="Add Strict-Transport-Security when HTTPS" enabled="true"&gt;
                      &lt;match serverVariable="RESPONSE_Strict_Transport_Security"
                          pattern=".*" /&gt;
                      &lt;conditions&gt;
                          &lt;add input="{HTTPS}" pattern="on" ignoreCase="true" /&gt;
                      &lt;/conditions&gt;
                      &lt;action type="Rewrite" value="max-age=31536000" /&gt;
                  &lt;/rule&gt;
              &lt;/outboundRules&gt;
          &lt;/rewrite&gt;
      &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>