4 ms·
Don't casually enable HSTS with the following: add_header Strict-Transport-Security "max-age=63072000; includeSubdomains" always; On a top domain site like ht
by grafelic 8y ago
Don't casually enable HSTS with the following:
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains" always;
On a top domain site like https://example.com https://example.com, if there are subdomain sites like http://golf.example.com http://golf.example.com which are not configured with TLS. The setting will be stored on the clients and they need to "forget" non-https sites after you have rolled back the misconfiguration. Of course you could go in the other direction and enable https for all subdomains. :)