title: How do I only serve the HSTS header on https:// and not on http:// requests
body: <p>I am implementing HSTS. The check on <a href="https://hstspreload.org/" rel="nofollow noreferrer">https://hstspreload.org/</a> tells me that it's all good but I serve the HSTS header over HTTP which is unnecessary.</p>
  <p><strong>Warning: Unnecessary HSTS header over HTTP
  The HTTP page at <a href="http://www.domain.com" rel="nofollow noreferrer">www.domain.com</a> sends an HSTS header. This has no effect over HTTP, and should be removed.</strong></p>
  <p>Now, I don't see it as a big problem but the pedantic nature inside me wants to fix it. I saw <a href="https://stackoverflow.com/questions/927358/how-do-i-undo-the-most-recent-local-commits-in-git">this</a> thread successfully resolving it but I want to ask how can I achieve this on my IIS. I am running an IIS on Windwos. Any help is reallly appreciated</p>
  <p>[EDIT]
  Some people misunderstood my question so sorry about that. What hstspreload website suggests is that you should only serve the HSTS header over https:// and that it useless to serve it on http:// requests. So my question is **&quot;How do I only serve the header on https:// and not on http:// requests. I have implemented the HSTS header through IIS web.config. **</p>