[HTTPSSettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [HTTPSSettings] of settings/velocity.ini.
File
settings/velocity.ini; override it in settings/override/velocity.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Enabled | false | manual uses the certificate and key below. Leave Enabled=false to serve plain HTTP only. |
| Certificate | (empty) | |
| Key | (empty) | |
| HSTSMaxAge | 0 | Strict-Transport-Security on every answer sent over HTTPS: static files, the server's own pages and the scripts' answers, unless an answer carries one already. Never over plain HTTP. In seconds; 0 (the default) sends none. A browser that has seen the header refuses plain HTTP to this host name, on every port, for that long, and keeps doing so after the setting is lowered, so it is off until an installation asks for it in settings/override. Start small (300), and raise it in stages (a day is 86400, a year is 31536000) only once every name of the site is served over HTTPS for good. Where a front end (Apache, nginx, a CDN) sends the header for the same host name already, use the same value here. |
| HSTSIncludeSubDomains | disabled | Also for every subdomain of the host (enabled or disabled). |
| HSTSPreload | disabled | Ask to be put on the browsers' preload lists (enabled or disabled). Needs HSTSIncludeSubDomains and a max-age of at least a year to be accepted. |
See also
Generated example: velocity.ini [HTTPSSettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/velocity.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment