HTTP has some weaknesses that make it a bad choice for confidential communications. HTTPS protocol is essentially HTTP, except for the difference that it encrypts the data being transferred between you and your server. This led to the development of HTTP Secure or HTTPS. HTTPS Secure can be used by hackers to bypass HTTPS encryption and fool your browser into communicating over insecure HTTP protocol. The solution to this problem of protocol downgrade attacks is HTTP Strict Transport Security (HSTS) policy. HSTS policy is enabled by adding the following field to your HTTPS response header: max-age=expireTime [; includeSubdomains]”]
Source: https://gbhackers.com/https-strict-transport-security/