It's part of the HSTS spec that a server receiving a request over HTTP should redirect to HTTPS.
I assume the logic here is that as it's best practice for any site with HTTPS to use HSTS also, all HTTPS sites should not be available over HTTP apart from a redirect to the secure version of the page.
Comments
It's part of the HSTS spec that a server receiving a request over HTTP should redirect to HTTPS.
I assume the logic here is that as it's best practice for any site with HTTPS to use HSTS also, all HTTPS sites should not be available over HTTP apart from a redirect to the secure version of the page.