Auto replace links to HTTPS - how to enable or disable HSTS, preload option
After the general introduction of the HTTPS protocol, it became necessary in some way to redirect site visitors to open pages through this protocol. This can usually be done with rules in the .htaccess file at the root of the site. However, since HTPPS has become extremely popular and is used everywhere today, there should have been a convenient way to automatically replace links on a site with HTTPS without writing unnecessary rules.
What is HSTS
There is such a method - this technology is called HSTS (HTTP Strict Transport Security). What is HSTS ? This option, which enables a forced secure HTTPS connection, is recommended for increased security. In other words, the browser will open all requests on your site via HTTPS, even if the links are written with HTTP.
Using HSTS eliminates the need to manually edit links with HTTP, but this only applies to the current domain, and links can also be placed to third-party domains. Still, it is better not to rely only on automatic replacement of links to HTTPS, but to additionally correct all links on the site in relative or absolute addresses with an explicit indication of the protocol.
How to enable HSTS
This became possible due to the appearance of a new heading, you can use any of the three recording options:
Strict-Transport-Security: max-age = & lt; expire-time> Strict-Transport-Security: max-age = & lt; expire-time>; includeSubDomains Strict-Transport-Security: max-age = & lt; expire-time>; preload
The first option for a post just sends a title, just specify the time it will be valid. The second option tells the browser that the rule applies to all subdomains as well. The last third option is unofficial, but people often ask what HSTS preload means.
What is HSTS preload ? This is an option to use preload lists. Such lists are compiled by large companies and are used by all browsers. Google is doing this right now, providing preload lists for its Chrome browser as well as other browsers.
Why are there such HSTS preload lists ? This allows browsers to know even before visiting the site that the specified site (domain) and all its pages should be opened only via HTTPS. There is a special project (currently available at hstspreload.org ) that serves requests. He accepts applications for inclusion of sites in such a list (green form above), as well as deleting a site, if necessary, from this list (gray form below). Before submitting an application for addition, you need to make sure that all pages of the site work via HTPPS and that you can support this protocol for a long time. It will take a long time to remove a domain from this list.
How to disable HSTS
Last but not least, how to disable HSTS ? The same header needs to be sent, only with the max-age time set to 0. This will immediately disable HSTS and allow HTTP access.
There is also an option to disable HSTS , it may differ for each browser. For example, for Chrome, you need to go to chrome: // net-internals / # hsts and delete the domain via the "Delete domain security policies" section. It is enough to enter your domain address in the “Domain” field and press “Delete”. After completing these actions when entering the site, it is better to force the protocol http: // , otherwise the browser can automatically open it out of habit via HTTPS .
- 09.11.23IT / Database Errors when migrating from MySQL 5.6 to 5.7 and how to fix them - database dump import failed with an error or INSERT does not work. Disabling STRICT_TRANS_TABLES strict mode or using IGNORE
- 09.07.22IT / Misc Convert office files DOC, DOCX, DOCM, RTF to DOCX, DOCM, DOC, RTF, PDF, HTML, XML, TXT formats without loss and markup changes
- 07.07.22IT / Safety How to protect PHP, JS, HTML, CSS source code - obfuscation, minification, compression and encryption
- 06.07.22IT / Safety Connection not secure, problem with Lets Encrypt - how to fix expired 09/30/2021 DST Root CA X3, remove it manually and install ISRG Root X1. Example on MS Windows 7
- 08.07.21IT / Misc How to make a free translation for a website without an API, translate documents in Google Translate