title: Does HSTS header really help against MITM attacks?
body: <p>I've read OWASP's HSTS cheat sheet at 
  <a href="https://www.owasp.org/index.php/HTTP_Strict_Transport_Security#Browser_Support" rel="nofollow">https://www.owasp.org/index.php/HTTP_Strict_Transport_Security#Browser_Support</a>
  and also watched the related video:
  <a href="https://www.youtube.com/watch?v=zEV3HOuM_Vw" rel="nofollow">https://www.youtube.com/watch?v=zEV3HOuM_Vw</a></p>
  
  <p>but still I can't understand how this helps against man-in-the-middle attacks in case of user typing http ://site.com. OWASP claims it helps.</p>
  
  <p>Let's imagine the following scenario: the middle man gets request from victim: http ://site.com. Then he fires HTTPS request himself to https ://site.com and returns content to the user, stripping the HSTS header. All further user input is visible to the attacker.</p>
  
  <p>In my mind, there's no way to protect against MITM unless we're using HTTPS from the beginning. </p>
  
  <p>Does HSTS header really help against MITM attacks?</p>