Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hsts]

HTTP Strict Transport Security is a security feature that lets a web site tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.

2
votes
1answer
12 views

When redirecting to another domain, to which domain will HSTS apply?

Assuming the following, what domain will be HSTS'ed for the next year, foo.com or bar.com? RTFM (RFC6797) doesn't help much. > GET / HTTP/1.1 > Host: foo.com [ ... ] < HTTP/1.1 301 Moved ...
4
votes
1answer
53 views

ERR_TIMED_OUT when accessing S3 bucket by a custom domain that uses Route53

I have set up a static website by following this walkthrough: https://docs.aws.amazon.com/AmazonS3/latest/dev/website-hosting-custom-domain-walkthrough.html I can see the website by accessing its ...
1
vote
1answer
88 views

HSTS implementation when using www.TLD

Been looking at implementing HSTS in to one of our sites, hoping to validate it on the preload list. But I can't get my head around how it works with the www. Subdomain. Our site forces secure www....
6
votes
2answers
569 views

HSTS Preload section on .htaccess

Recently having moved a site to SSL, I looked into enforcing HSTS for eventual preload. The syntax is approved and the Chrome List allows it to be OK. However, not being a coder at all, a slight ...
1
vote
1answer
319 views

Link subdomain that is CNAME to SendGrid but with CloudFlare enabled ends up on main site

We use Cloudflare, and Sendgrid for email. Via Sendgrid setup, we have added a DNS record: However, this redirects to our main domain: Example link.construct.net generated by SendGrid If I disable ...
8
votes
1answer
310 views

Will implementing HSTS prevent Googlebot from seeing 301 permanent redirects from HTTP to HTTPS?

I did a migration from http:// to https:// for a big site with more than 2 million of URLs indexed on Google. As others have mentioned I'm also experiencing a bit of fluctuation on organic traffic (-...
0
votes
0answers
9 views

Web hosting service with support for HTTPS, HSTS, HPKP [duplicate]

Currently, I have my website deployed on a private server, but I'm looking to move to a "real" web hosting service to better serve my readers. I kind of believe in good encryption on the web. ...
2
votes
0answers
397 views

CloudFlare and Avast strict transport

This weekend, we started using CloudFlare*. One of our users is reporting that Avast, the anti-virus software, has blocked our site due to a certificate error. Presumably this is because our ...
2
votes
1answer
620 views

Removal from HSTS preload list?

A client has moved their website to another provider who does not support secure (HTTPS) browsing. The previous site was served over HTTPS and sent HSTS headers and was included on the Chrome HSTS ...
8
votes
4answers
2k views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...