What does HSTS do, and what problem does it solve that a simple HTTP to HTTPS redirect does not?

HSTS (HTTP Strict Transport Security) tells the browser to use only HTTPS for a site, even for the first request it types or clicks. A redirect cannot do this.

With a redirect from http:// to https://, the first request still goes over plain HTTP. An attacker on the network, for example on public Wi-Fi, can catch that request and keep the user on HTTP. This attack is called SSL stripping.

The Strict-Transport-Security header tells the browser: "for max-age seconds, contact this host only over HTTPS". The browser then:

• changes future http:// URLs to HTTPS by itself, before sending anything
• does not let users click past certificate errors
• applies the rule to all subdomains too, if the header has includeSubDomains

The header only works after the first secure visit. The preload directive says the site wants to join the browser preload lists. These lists are built into browsers, so even the very first visit uses HTTPS. Browsers ignore the header if it arrives over plain HTTP.