In more detail
A site sends the header Strict-Transport-Security: max-age=31536000; includeSubDomains. The value 31536000 is 365 days in seconds. For that period the browser rewrites any http:// request for the site to https:// before sending it, and refuses to continue past certificate errors. includeSubDomains extends this to all subdomains, and a preload option lets a site ask to be built into browsers' lists. The header is only trusted when it arrives over HTTPS.
Why it matters
Without HSTS, the first request to http://example.com travels in clear text before a Redirect sends the visitor to HTTPS, which gives an attacker on the network a chance to intercept or downgrade the connection. HSTS closes that window for every visit after the first. Because it is hard to undo, a site should check that every subdomain works over TLS before enabling includeSubDomains.
Example
Check whether a site sends HSTS and how long it lasts with the Security Headers Analyzer, and trace the HTTP to HTTPS redirect with the HTTP Redirect Chain Tracer.
Common confusion
HSTS does not replace the redirect from HTTP to HTTPS: the redirect is still needed for the first visit. It also does not encrypt anything itself; it only makes sure the browser uses HTTPS.