title: Do I need to enable HSTS in addition to forcing HTTPS in .htaccess?
body: <p>I know nothing about this stuff so please ELI5 in your replies.</p>
  
  <p>Following the instructions from my provider, Dreamhost, I installed an SSL certificate and then added these lines to my .htaccess file to force HTTP requests to be rewritten to HTTPS requests.</p>
  
  <pre><code># Redirect http requests to https
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  </code></pre>
  
  <p>Everything seems to be working correctly, ie: every time I try to access a page under that domain with HTTP, it is rewritten to HTTPS and the "Secure" icon shows in the address bar.</p>
  
  <p>My question is, do I need to also enable HSTS? Reading about it, it seems to do the exact same thing as the previous changes to the .htaccess file. Here's <a href="https://www.a2hosting.com/kb/security/ssl/enabling-http-strict-transport-security-hsts-for-your-site" rel="nofollow noreferrer">an excerpt from A2 Hosting</a> (not my provider):</p>
  
  <blockquote>
    <p>Enabling HSTS</p>
    
    <p>When HSTS is enabled for a site, web browsers automatically change any
    insecure requests (http://) to secure requests (https://). All you
    need to do to enable HSTS is add a header to your site's .htaccess
    file. Web browsers recognize this header, and then take care of the
    rest without any further intervention on your part.</p>
  </blockquote>
  
  <p>They suggest adding this to .htaccess:</p>
  
  <pre><code>Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
  </code></pre>
  
  <p><a href="https://annevankesteren.nl/2016/02/dreamhost-https" rel="nofollow noreferrer">Another tutorial</a>, this time specific to Dreamhost, says to enable HSTS along with forcing HTTPS in the .htaccess file, but doesn't really say why. This page suggests something slightly different:</p>
  
  <pre><code>Header set Strict-Transport-Security "max-age=31415926; includeSubDomains; preload" env=HTTPS
  </code></pre>
  
  <p>Do I need the "https rewrite" code snippet AND HSTS? Or is having only the "https rewrite" code snippet good enough? Do I need the HSTS code at all, and if so, what's the difference between the two lines of HSTS code in my post?</p>