Support

You need to turn both settings on. The two settings are complementary.

You may wonder why you need the HSTS header. It's a more secure setup. Without it, trying to access http://www.example.com means that the browser contacts the site over the unencrypted, plain old HTTP channel and Joomla! sends it a redirect to https://www.example.com. This means that any information to the site, including the login cookie, will be transferred over unencrypted HTTP and there's a security and privacy risk there. With the HSTS header the browser will NOT attempt to use the HTTP channel at all. It will convert http://www.example.com to https://www.example.com BEFORE making the network connection. Thus no information is exchanged over insecure, plain only HTTP. The thing is that the very first time you access the site someone needs to tell the browser to use the HTTPS version. That's what the Joomla! setting does.