1

I have a website which is using the free Cloudflare service and have enabled HTTP Strict Transport Security (HSTS) preloading on it.

If I wish to remove the domain from Cloudflare and route directly to my server where the domain is hosted with a valid SSL certificate will the site remain accessible regardless of if the max-age timeframe has expired or not?

The only location I have enabled HTTP Strict Transport Security (HSTS) is inside of the Cloudflare console, it's not actually configured on the origin server.

Cloudflare HSTS Warning Panel Source

Thanks.

3 Answers 3

1

HTTP Strict Transport Security (HSTS) doesn't prevent you from changing your DNS records to point to a different IP address, it just prevents HSTS enabled browsers (that have seen the HSTS header or have been preloaded, i.e. Chrome) from attempting to connect via HTTP (vs. HTTPS).

All it does is cause the HSTS capable browser to change a request for http://example.com to https://example.com before sending the request, thereby ensuring that no information is ever sent in the clear.

The Cloudfare warning just tells you that when you change hosting companies, you need to make sure that you also have a valid SSL installed at the new site.

Because you have the valid SSL certificate at the new hosting location, you are good to go. Just update your DNS and carry on!

If you are keeping SSL, there is no reason to disable HSTS. On the other hand, not having HSTS on an SSL capable site makes that site less secure because traffic that would have been prevented by HSTS from flowing via HTTP is able to traverse the Internet in the clear.

As far a HSTS "preloading," this is the process of companies like Google preloading the HSTS header in the Chrome browser (as opposed to the browser having to have visited the site once before it stores the header). Like all HSTS header information, preloaded HSTS information is stored by hostname, not IP address. You are always free to change the IP address at which the site is hosted. On the other hand, dropping SSL after you have enabled HSTS is what will make it hard (if not impossible) for some users to visit your site.

0

We (CloudFlare) propagate DNS pretty quickly. There's a reasonable chance that a cached version could be served up initially, but it would be for no more than 300 seconds (probably less).

0

Colt's answer is the right one.

However, to add a little more on preloading:

If you have the "preload" tag set in your header, then you can submit the site to a preload list so the fact you use HSTS is baked into the browser, rather than based on whether the browser last saw the header within the max-age time.

It also seems some browsers proactively add your site to their preload list when they see a header containing the preload keyword. So you may be preloaded without realising it.

The easiest place to check is at https://www.ssllabs.com/ssltest/ and near the bottom there is HSTS Preloading field that will tell you which browsers preloading lists your site is on.

This is important for two reasons:

  1. You may not realise your site is preloaded and after some time away from Cloudflare may think it's safe to turn of HTTPS - but it might not be.

  2. You may want to remain preloaded but Chrome are warning that they may, in future, remove domains from the in-built list if the domain does not continue to provide the header with the preload keyword. In which case if you wish to remain you should add the correct HSTS header to your base server.

And finally you should be aware that preloading (usually) demands the "includesubdomains" argument so all subdomains of your domain may also be on preload list even if you never explicitly published that header on the subdomain.

Preloading adds a fair bit of complexity and restrictions so need to fully understand what this means if you ever want to revert back to HTTP for some reason.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .