3 ms·
The most secure approach is to serve everything over HTTPS AND redirect HTTP to HTTPS WITH "Strict-Transport-Security" header [1]. Even this is not perfect, but
by bjornsing 11y ago
The most secure approach is to serve everything over HTTPS AND redirect HTTP to HTTPS WITH "Strict-Transport-Security" header [1]. Even this is not perfect, but it's the best approach available AFAIK.
1.https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
- ultramancool 11y agoYou can also submit your site for inclusion on the HSTS preload lists: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/ This fixes the remaining hole of the first visit. However, one warning, if you like privacy, you should turn off HSTS or clear it on browser close at least. It's effectively a giant supercookie and it provides little security benefit over checking URLs for SSL yourself.
- bjornsing 11y agoThanks, that's good to know. :)