3 ms·

I'd recommend starting out with a small max-age value so that any mistaken records will expire quickly. (Disclosure: I'm a co-editor of the HSTS RFC.)

• gellerb 12y ago
  Yeah. I noticed that paypal.com has a max-age of 4 hours.
  • rhoml 12y ago
    Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.
    • d0ugie 12y ago
      Is there any downside, when using SSL, in enabling perfect forward secrecy?
      • JshWright 12y ago
        Make sure you're using an SSL library that support ECDHE cipher suites... the non EC suites are very slow.