A web security policy that forces browsers to interact with websites only over HTTPS, preventing users from accidentally accessing an insecure version of a site.