Ensuring security is set up correctly for your website is very important, especially when it comes to protecting yourself from hackers. The rapid development of new technologies, strict compliance standards, and evolving threats from hackers make it essential to keep your business\u2019 security tools up-to-date and as strong as possible.<\/p>\n\n\n\n\n\n\n\n
FastComet is proud to provide its customers with the most state-of-the-art online security solutions available. It\u2019s our responsibility to make sure all our customers are well-protected and secure at every level. HSTS (HTTP Strict Transport Security) is yet another brick in the firewall of defense against fraud. It makes your SSL implementation more secure by closing a couple of key attack vectors. Best of all, we have ensured its setup is quick, easy and free.<\/p>\n\n\n\n
You should already know that HTTPS is now a requirement for any websites. Beginning in July 2018 with the release of Chrome 68, Chrome browser will mark all HTTP sites as \u201cnot secure\u201d and prominently highlight this in its URL bar which will quickly scare away visitors. And yes, we did say “all.” The urge to get rid of unsecured navigation has never been stronger: each release of Google Chrome or Mozilla Firefox comes with a new warning sign for users sharing private data. Even if you don\u2019t care that much about your own website security, Google does. HTTPS is a small ranking factor in Google in organic web search algorithms and is categorized as a \u2018site quality\u2019 score along with many other factors such as page speed and mobile responsiveness. There are numerous different enhancements and best security practices you can implement to ensure that your site is locked down.<\/p>\n\n\n\n
But padlocking your website is still not enough to automatically redirect all your HTTP traffic to the HTTPS secured version as people will eventually find a way to reach your website over HTTP:\/\/. This is why one of the enhancements we recommend implementing is the HTTP Strict Transport Security over HTTPS. Doing so helps prevent SSL protocol attacks, SSL stripping, cookie hijacking, and other attempts to circumvent SSL protection. And the best part is that you greatly improve your overall SSL rating with FastComet.<\/p>\n\n\n\n
HTTP Strict Transport Security<\/a> (commonly referred to as HSTS) is an opt-in browser security mechanism that lets website owners declare \u201cEncrypted Communications Only\u201d. The Strict-Transport-Security HTTP header instructs browsers to only interact with the domain over secure HTTPS protocol (SSL\/TLS) for a set period of time (the max-age header which we are adding in the .htaccess file while enabling HSTS). HSTS only goes into effect after a browser receives a valid header from the domain. The goal of HSTS is to ensure unencrypted communication between the client and the browser, is not allowed on your site and to mitigate attacks such as Man-in-the-Middle (MITM) which might attempt to keep you on HTTP.<\/p>\n\n\n\n But why do you need this when you already have redirected your site to SSL? Obtaining an SSL Certificate will never be enough. Although websites may have implemented SSL certificate through SSL technology like Let\u2019s Encrypt<\/a>, more often than not the web browsers use HTTP first and then make the switch to HTTPS, even for websites which support this security protocol. Therefore this dangerous gap \u2013 before the switch is made \u2013 leaves the connection exposed to hackers. HSTS technology can help eliminate this dangerous gap.<\/p>\n\n\n\n Although our systems prefer the HTTPS version by default, you can also make this clearer for other search engines by redirecting your HTTP site to your HTTPS version and by implementing the HSTS header on your server. Zineb Ait Bahajji<\/a>, Google Security Team<\/p><\/blockquote>\n\n\n\n HSTS is not a replacement for HTTPS. HSTS is meant for situations when users are not actually visiting your site, but a site that is pretending to be your site, and therefore does not have an SSL certificate. So this fake site won\u2019t have a redirect to SSL!<\/p>\n\n\n\n When HSTS is enabled for a site, web browsers automatically change any insecure requests (HTTP:\/\/) to secure requests (https:\/\/). All you need to do to enable HSTS is add a header to your site’s .htaccess file. Web browsers recognize this header, and then take care of the rest without any further intervention on your part. Follow our step by step tutorial on How to enable HSTS<\/a>.<\/p>\n\n\n\n There\u2019s something called HSTS preload list<\/a> \u2013 which is nothing but a list of HSTS enabled websites \u2013 that is automatically stored in the browsers. Google officially compiles this list and it is utilized by Chrome, Firefox, Opera, Safari, IE11, and Edge. Submit your site to the official HSTS preload list<\/a>. Equipped with this HSTS preload list, the browser when accessing a website will check whether the website it\u2019s trying to access figures on this list, and if it does, the browser will automatically start using the secure HTTPS connection.<\/p>\n\n\n\n However, in order to be eligible for the HSTS preload list through this form, your site must satisfy the following set of requirements:<\/p>\n\n\n\n The preload directive is non-standard, but important since once this is all up and running you want to submit your domain for HSTS preloading. It should be noted though that inclusion in the preload list cannot easily be undone<\/a>. Don’t request inclusion unless you’re sure that you can support HTTPS for your entire site and all its subdomains in the long term.<\/p>\n\n\n\n There are many SSL checkers out there which are used to check the validity and installation of a websites SSL Certificate. If you are not too sure how secure your website is, try testing it here:<\/p>\n\n\n\nEnabling HSTS<\/h2>\n\n\n\n
How to Enable Browser Pre-recognition of HSTS?<\/h2>\n\n\n\n
Passing SSL Check with an A+ Grade<\/h2>\n\n\n\n