Support

I am afraid you are wrong. The feature you say doesn't exist has actually been around for almost six years.

Admin Tools' .htaccess Maker has offered the HSTS feature since version 2.6.0, released on December 27th, 2013. This feature uses .htaccess to send an HTTP header which informs the visitor's site to always use HTTPS to access your site. Furthermore, if your first-time visitor tries to access your site through HTTP it will perform a redirection to HTTPS. This all happens at the .htaccess level long before PHP, let alone Joomla, had the chance to load.

The support guy is not wrong, he's right and I actually agree with him. When you use PHP to perform a redirection the request has to go through Apache parsing the .htaccess file, launching the PHP interpreter, PHP parsing the file, executing it and passing data back to Apache which will then send it to the browser. Depending on how many system plugins run on your site and how long it takes to run them this can take anywhere from 0.3 to 5 seconds. A .htaccess based redirection happens very fast, at the beginning of handling the request. It typically takes less than 0.02 seconds. So, yeah, there's a massive difference.

I would, however, argue that on the average site this happens infrequently enough that it makes no practical difference.

That said, HSTS is more than just a redirection. The redirection only happens the first time someone visits your site. Every next access of that browser to your site will always happen using HTTPS even if the user enters a URL or follows a link with an "http://" protocol prefix to your site. HSTS is basically your site telling the user's browser "no matter what they tell you, always use HTTPS to talk to me".

If you enable HSTS Joomla's setting is irrelevant for redirections. You will never reach a point where Joomla needs to perform a redirection to HTTPS. However, that setting also controls how Joomla outputs URLs so, yes, you must set this option to "Entire site" to make sure your site is not just always accessible over HTTPS but also only outputs HTTPS internal links.