title: Enabling HSTS without forcibly redirecting to HTTPS?
body: <p>This seems like a silly question but I am wondering:</p>
  
  <ul>
  <li>How is HSTS deployed without <em>forcibly redirecting users to HTTPS</em>?</li>
  <li>How is HTTP content still served from the same domain as one using HSTS? (Either an entire site or mixed content)</li>
  <li>Why would anyone do this?</li>
  </ul>
  
  <p>I'm reading <a href="https://www.eff.org/https-everywhere/deploying-https" rel="nofollow">from the EFF site</a> and it appears that <em>that</em> was done:</p>
  
  <blockquote>
    <p>We recently enabled HSTS for eff.org. It took less than an hour to set up, and we found a way to do it without forcibly redirecting users to HTTPS, so we can state an unequivocal preference for HTTPS access while still making the site available in HTTP. It worked like a charm and a significant fraction of our users are now automatically accessing our site in HTTPS, perhaps without even knowing it.</p>
  </blockquote>
  
  <p>As I'm aware, HSTS works by sending an HTTP header:</p>
  
  <pre><code>Strict-Transport-Security: max-age=31536000
  </code></pre>
  
  <p>So if I access a page on <a href="https://example.net/" rel="nofollow">https://example.net/</a> that sends that header, all future requests to the domain example.net for the next 31536000 seconds will use HTTPS, and if the (response?) is HTTP then the browser will show giant red warnings.</p>
  
  <p>Can someone please clarify this for me? Is my understanding of HSTS accurate or am I missing something?</p>