Questions tagged [hsts]

HTTP Strict Transport Security is a security feature that lets a web site tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.

Filter by
Sorted by
Tagged with
0 votes
0 answers

Does the SSL certificate has to be valid for the www subdomain

The .htaccess successfully diverts all variants to on the browsers. And I have appropriate CSP headers (that work on all other sites in different installations) installed in htaccess. I ...
Rohit Gupta's user avatar
  • 2,466
2 votes
0 answers

Deploy HSTS including subdomains if main domain is www (no preloading yet)

I want to deploy HSTS for * but we don't have web content on Instead, is our main site and we have hundreds of (partly unknown) subdomains, so we don't want to ...
xsrf's user avatar
  • 226
2 votes
1 answer

How do I get .app TLD to work with my .htaccess

I have a number of domains hosted on one server. I tried them as sub-domains but that was a failure. So I obtained new certificates and I have them configured as Add-On_Domains. They are all using ...
Rohit Gupta's user avatar
  • 2,466
6 votes
1 answer

HSTS affect on SEO

I do back-end work work for a couple of fairly knowledgeable people in the SEO field (i.e. not people off the street just claiming to be SEO experts). One of them is advising that HSTS improves SEO, ...
davidgo's user avatar
  • 7,939
1 vote
0 answers

HSTS and redirecting to www. sub domain

I am trying to setup HSTS for my website but running into some problems regarding the response headers and the use of a sub domain. What I would like is for all HTTP traffic to redirect to https://www....
Ross Hodgman's user avatar
1 vote
0 answers

How long does Chrome take for HSTS preload list inclusion?

Assuming that my domain meets the inclusion requirements, and I successfully submit it to, then: How long does it take on average until Chrome comes out with a new stable release with ...
Maximillian Laumeister's user avatar
2 votes
1 answer

When redirecting to another domain, to which domain will HSTS apply?

Assuming the following, what domain will be HSTS'ed for the next year, or RTFM (RFC6797) doesn't help much. > GET / HTTP/1.1 > Host: [ ... ] < HTTP/1.1 301 Moved ...
Yegor Gorshkov's user avatar
4 votes
1 answer

ERR_TIMED_OUT when accessing S3 bucket by a custom domain that uses Route53

I have set up a static website by following this walkthrough: I can see the website by accessing its ...
Ali Alavi's user avatar
5 votes
2 answers

HSTS implementation in .htaccess when using www subdomain

Been looking at implementing HSTS in to one of our sites, hoping to validate it on the preload list. But I can't get my head around how it works with the www. Subdomain. Our site forces secure www....
Randomer11's user avatar
9 votes
2 answers

HSTS Preload section on .htaccess

Recently having moved a site to SSL, I looked into enforcing HSTS for eventual preload. The syntax is approved and the Chrome List allows it to be OK. However, not being a coder at all, a slight ...
Claverhouse's user avatar
1 vote
1 answer

Link subdomain that is CNAME to SendGrid but with CloudFlare enabled ends up on main site

We use Cloudflare, and Sendgrid for email. Via Sendgrid setup, we have added a DNS record: However, this redirects to our main domain: Example generated by SendGrid If I disable ...
Tom Gullen's user avatar
  • 2,390
8 votes
1 answer

Will implementing HSTS prevent Googlebot from seeing 301 permanent redirects from HTTP to HTTPS?

I did a migration from http:// to https:// for a big site with more than 2 million of URLs indexed on Google. As others have mentioned I'm also experiencing a bit of fluctuation on organic traffic (-...
Jonathan Meyer's user avatar
2 votes
0 answers

CloudFlare and Avast strict transport

This weekend, we started using CloudFlare*. One of our users is reporting that Avast, the anti-virus software, has blocked our site due to a certificate error. Presumably this is because our ...
DMCoding's user avatar
  • 161
2 votes
1 answer

Removal from HSTS preload list?

A client has moved their website to another provider who does not support secure (HTTPS) browsing. The previous site was served over HTTPS and sent HSTS headers and was included on the Chrome HSTS ...
Andrew Lott's user avatar
  • 5,854
10 votes
4 answers

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
Kevin Burke's user avatar