velocity.ini [HTTPSSettings] #

The block [HTTPSSettings] of settings/velocity.ini, with 6 setting(s).

Never edit settings/velocity.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/velocity.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/velocity.ini.append.php for one siteaccess,
• extension/<extension>/settings/velocity.ini.append.php in an extension (read when the extension is active).

Enabled #

manual uses the certificate and key below. Leave Enabled=false to serve
plain HTTP only.

Default: false.

<?php /* #?ini charset="utf-8"?
# settings/override/velocity.ini.append.php
[HTTPSSettings]
Enabled=false
*/ ?>

Certificate #

Default: empty.

<?php /* #?ini charset="utf-8"?
# settings/override/velocity.ini.append.php
[HTTPSSettings]
Certificate=
*/ ?>

Key #

Default: empty.

<?php /* #?ini charset="utf-8"?
# settings/override/velocity.ini.append.php
[HTTPSSettings]
Key=
*/ ?>

HSTSMaxAge #

Strict-Transport-Security on every answer sent over HTTPS: static files,
the server's own pages and the scripts' answers, unless an answer carries
one already. Never over plain HTTP. In seconds; 0 (the default) sends none.

A browser that has seen the header refuses plain HTTP to this host name, on
every port, for that long, and keeps doing so after the setting is lowered,
so it is off until an installation asks for it in settings/override. Start
small (300), and raise it in stages (a day is 86400, a year is 31536000)
only once every name of the site is served over HTTPS for good. Where a
front end (Apache, nginx, a CDN) sends the header for the same host name
already, use the same value here.

Default: 0.

<?php /* #?ini charset="utf-8"?
# settings/override/velocity.ini.append.php
[HTTPSSettings]
HSTSMaxAge=0
*/ ?>

HSTSIncludeSubDomains #

Also for every subdomain of the host (enabled or disabled).

Default: disabled.

<?php /* #?ini charset="utf-8"?
# settings/override/velocity.ini.append.php
[HTTPSSettings]
HSTSIncludeSubDomains=disabled
*/ ?>

HSTSPreload #

Ask to be put on the browsers' preload lists (enabled or disabled). Needs
HSTSIncludeSubDomains and a max-age of at least a year to be accepted.

Default: disabled.

<?php /* #?ini charset="utf-8"?
# settings/override/velocity.ini.append.php
[HTTPSSettings]
HSTSPreload=disabled
*/ ?>

Related #

• All blocks of velocity.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/velocity.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.