Is there a way to force an SSL lock without using a 301 redirect, such as server side?
I'm happy to supply context if requested.
Webmasters Stack Exchange is a question and answer site for pro webmasters. It only takes a minute to sign up.
Sign up to join this communityIs there a way to force an SSL lock without using a 301 redirect, such as server side?
I'm happy to supply context if requested.
It's unclear to me what your use case is, but here is a solution to your question as it's worded. You can use HSTS preloading to ensure that all modern browsers always connect using HTTPS, without the need for a 301 redirect (though keeping a 301 redirect active is recommended).
Note that to be eligible for HSTS preload list inclusion, you must do one of the following:
Set up a redirect from HTTP (port 80) to HTTPS, or
Refuse all HTTP (port 80) connections
Once your site is submitted, it will take a few months for the list to be published to web browsers. Then, browsers will ONLY connect to your site via HTTPS. Removal from the HSTS preload list (and removal of HSTS in general) is messy and takes a long time, so be absolutely sure that this is the solution for you before you implement it.
.dev
domain because the entire top level domain is already on the HSTS preload list.
– Stephen Ostermiller♦
May 23 '19 at 17:53
.APP
, .PAGE
or others: .BANK
, .INSURANCE
.
– Patrick Mevzek
Jun 3 '19 at 23:28
strict-transport-security
header with some constraints on values allowed.
– Patrick Mevzek
Jun 3 '19 at 23:33