title: HSTS understanding
body: <p>I'm interested in HSTS mechanism and want to clarify following moment:</p>
  
  <p>For example, there is site <a href="https://example.com" rel="nofollow noreferrer">https://example.com</a> exists. I use <a href="http://chrome://net-internals/#hsts" rel="nofollow noreferrer">chrome://net-internals/#hsts</a> to check if HSTS enabled there. And it shows the next information:</p>
  
  <pre><code>static_sts_domain: 
  static_upgrade_mode: UNKNOWN
  static_sts_include_subdomains: 
  static_sts_observed: 
  static_pkp_domain: 
  static_pkp_include_subdomains: 
  static_pkp_observed: 
  static_spki_hashes: 
  dynamic_sts_domain: example.com
  dynamic_upgrade_mode: FORCE_HTTPS
  dynamic_sts_include_subdomains: true
  dynamic_sts_observed: 1524145911.957196
  dynamic_sts_expiry: 1555681911.957194
  dynamic_pkp_domain: 
  dynamic_pkp_include_subdomains: 
  dynamic_pkp_observed: 
  dynamic_pkp_expiry: 
  dynamic_spki_hashes:
  </code></pre>
  
  <p>So I expect and think that HSTS is enabled there. But at the same moment there is no <code>Strict-Transport-Security</code> header in response. Why does chrome show such information and is HSTS enabled for that site? </p>