SEC-281: Add awareness of HSTS to secutiry.adoc for strict transport security.

Author: Karl Kemister-Sheppard

modules/ROOT/pages/security.adoc

@@ -55,6 +55,21 @@ SVGs (Scalable Vector Graphics) are not supported in {productname} to protect ou
 
 From the 1st of January 2020, Security Advisories for patched XSS vulnerabilities will be published on the https://github.com/tinymce/tinymce/security/advisories?state=published[{productname} GitHub repository Security page].
 
+[[enforcing-https-with-hsts]]
+=== Enforcing HTTPS with HSTS
+
+The {companyname} security team strongly recommends that customers embedding {productname} configure their web servers to include the HTTP Strict Transport Security (HSTS) header for websites served over HTTPS. This can be achieved by updating the server configurations to enable HSTS.
+
+HSTS ensures that encrypted communications are exclusively used, mitigates downgrade attacks, and enhances the protection of user data. While integrating HSTS is optional for {productname}, adopting this best practice significantly reduces the risk of vulnerabilities in projects utilizing {productname}.
+
+[IMPORTANT]
+Without HSTS, users accessing a website may be vulnerable to man-in-the-middle (MITM) attacks. Attackers can exploit this vulnerability by intercepting unencrypted HTTP traffic, redirecting users to malicious sites, or executing downgrade attacks to force connections over HTTP instead of HTTPS. This lack of encryption jeopardizes sensitive user data, including credentials, session cookies, and personal information. By enabling HSTS, these risks are effectively mitigated, as the browser enforces secure HTTPS connections for all future interactions with the site.
+
+For comprehensive guidance on implementing HSTS, refer to the following resources:
+
+* link:https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html[OWASP HSTS Cheat Sheet]
+* link:https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security[MDN Documentation on HSTS]
+
 [[keeping-dependencies-up-to-date]]
 === Keeping dependencies up-to-date