HTTPS and HSTS #

This page is for administrators and hosting teams. Many governments expect their public sites to be served only over HTTPS. HSTS (HTTP Strict Transport Security) makes browsers remember that and refuse plain HTTP to the host. In Exponential HSTS is empty by default and must be set by the operator once the whole site is HTTPS-only (Security standards: Known gaps).

Contents #

1. The order of steps
2. HSTS settings
3. Raising HSTS safely
4. Checking
5. Related pages

The order of steps #

From HTTPS everywhere:

1. Serve every name of the site over HTTPS: Velocity [HTTPSSettings] or its ACME support, Apache mod_ssl, nginx ssl.
2. Redirect plain HTTP to HTTPS (web server), or for individual subtrees [SSLZoneSettings].
3. Set [Session] CookieSecure=true.
4. Turn HSTS on, short first, and raise it once everything works.
5. Keep certificates renewed and watched (./console exp:velocity ssl show --json, field daysLeft, or your ACME client's timer).

HSTS settings #

For Apache or nginx, in settings/override/site.ini.append.php:

[HTTPHeaderSettings]
SecurityHeaders[Strict-Transport-Security]=max-age=300

The kernel sends it only over HTTPS. Clear the INI cache and reload PHP afterwards.

Raising HSTS safely #

A browser remembers HSTS for the whole period and refuses plain HTTP to that host, even after you lower the value.

Add includeSubDomains only when every subdomain of the domain is HTTPS-only: on a government domain that may include services run by other teams. Preload lists are hard to leave; decide with whoever owns the domain.

Checking #

curl -sI http://www.example.gov/ | head -3                        # a redirect to https
curl -sI https://www.example.gov/ | grep -i strict-transport
curl -sI https://www.example.gov/user/login | grep -i set-cookie   # Secure; HttpOnly; SameSite=Lax

Behind a proxy that terminates TLS, the kernel must know the request was HTTPS: configure TrustedProxies[] (see "Proxies and trusted headers"), or CookieSecure=true signs users out on every page.

Related pages #

• 13.9 Security headers and HTTPS
• Velocity HTTPS and certificates
• Going live: hosts and HTTPS
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.