title: HSTS in iFrame src
body: <p>I'm building an app that needs to serve websites in an iframe. Since the websites are decided by the user, they usually enter only the domain name, like google.com, or facebook.com. To render the website in an iframe i need to add http:// to this (I can't add https://, since the website may not be served over ssl which will cause it to not render at all.)</p>
  
  <p>For this reason, I am forced to not use ssl on my website, since due to the mixed content policy, I can't add iframes that request http. I wish to know if there's a way to force hsts in the iframe src. For example, if I request <a href="http://example.org" rel="nofollow noreferrer">http://example.org</a>, the iframe will automatically render <a href="https://example.org" rel="nofollow noreferrer">https://example.org</a> (since it exists.)</p>