Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hsts]

HTTP Strict Transport Security is a security feature that lets a web site tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.

1
vote
0answers
27 views

HSTS and redirecting to www. sub domain

I am trying to setup HSTS for my website but running into some problems regarding the response headers and the use of a sub domain. What I would like is for all HTTP traffic to redirect to https://www....
1
vote
0answers
32 views

How long does Chrome take for HSTS preload list inclusion?

Assuming that my domain meets the inclusion requirements, and I successfully submit it to hstspreload.org, then: How long does it take on average until Chrome comes out with a new stable release with ...
2
votes
1answer
17 views

When redirecting to another domain, to which domain will HSTS apply?

Assuming the following, what domain will be HSTS'ed for the next year, foo.com or bar.com? RTFM (RFC6797) doesn't help much. > GET / HTTP/1.1 > Host: foo.com [ ... ] < HTTP/1.1 301 Moved ...
4
votes
1answer
70 views

ERR_TIMED_OUT when accessing S3 bucket by a custom domain that uses Route53

I have set up a static website by following this walkthrough: https://docs.aws.amazon.com/AmazonS3/latest/dev/website-hosting-custom-domain-walkthrough.html I can see the website by accessing its ...
1
vote
1answer
119 views

HSTS implementation when using www.TLD

Been looking at implementing HSTS in to one of our sites, hoping to validate it on the preload list. But I can't get my head around how it works with the www. Subdomain. Our site forces secure www....
6
votes
2answers
777 views

HSTS Preload section on .htaccess

Recently having moved a site to SSL, I looked into enforcing HSTS for eventual preload. The syntax is approved and the Chrome List allows it to be OK. However, not being a coder at all, a slight ...
1
vote
1answer
340 views

Link subdomain that is CNAME to SendGrid but with CloudFlare enabled ends up on main site

We use Cloudflare, and Sendgrid for email. Via Sendgrid setup, we have added a DNS record: However, this redirects to our main domain: Example link.construct.net generated by SendGrid If I disable ...
8
votes
1answer
325 views

Will implementing HSTS prevent Googlebot from seeing 301 permanent redirects from HTTP to HTTPS?

I did a migration from http:// to https:// for a big site with more than 2 million of URLs indexed on Google. As others have mentioned I'm also experiencing a bit of fluctuation on organic traffic (-...
0
votes
0answers
9 views

Web hosting service with support for HTTPS, HSTS, HPKP [duplicate]

Currently, I have my website deployed on a private server, but I'm looking to move to a "real" web hosting service to better serve my readers. I kind of believe in good encryption on the web. ...
2
votes
0answers
399 views

CloudFlare and Avast strict transport

This weekend, we started using CloudFlare*. One of our users is reporting that Avast, the anti-virus software, has blocked our site due to a certificate error. Presumably this is because our ...
2
votes
1answer
636 views

Removal from HSTS preload list?

A client has moved their website to another provider who does not support secure (HTTPS) browsing. The previous site was served over HTTPS and sent HSTS headers and was included on the Chrome HSTS ...
8
votes
4answers
2k views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...