Questions tagged [hsts]

HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites.

Filter by
Sorted by
Tagged with
-1 votes
2 answers
106 views

Nginx forwarding presenting wrong certificate

I have a little problem with nginx. We have two subdomains we own, let's call them domain1.com and domain2.com. For domain2 we don't have further subdomains, for domain1 we have several. If someone ...
Richard Rosner's user avatar
0 votes
0 answers
5k views

IIS 10 will not redirect HTTP to HTTPS after enabling HSTS

I am attempting to force end users onto HTTPS when visiting our site. I have HSTS enabled in IIS at the site and application level. I have an HTTP redirect set up at the site level to https://...
Greg Burghardt's user avatar
1 vote
1 answer
307 views

Securing Apache Solr on an Apache TLS / SSL server

I have a SSL-only website hosted on a CentOS 7, Apache httpd based server. SSL certification is via a Let's Encrypt certificate. The domain has a HTTP Strict Transport Security (HSTS) policy. I am ...
Victoria Stuart's user avatar
1 vote
0 answers
2k views

IIS Version 1607 on Windows Server 2016 -- How to Add HTTP Strict Transport Security (HSTS) Support

Our servers are running Windows Server 2016 with IIS 1607. From what I can tell, this means the IIS 10 on the system is prior-to version 1709 where apparently Microsoft added the HSTS element under ...
Dan7el's user avatar
  • 133
6 votes
1 answer
4k views

My browser will not display http://[sub.]example.com

When I go to http://sub.example.com in my browser I get a "connection refused" message or an "invalid certificate" error but I don't even want to connect over https. As far as I ...
Bob's user avatar
  • 5,983
4 votes
0 answers
7k views

Enabling HSTS header on AWS Application Load Balancer

We have a Spring Boot application behind an AWS Application Load Balancer. The load balancer terminates SSL before forwarding coming requests to our application and also redirects 80 port to 443 port. ...
berkay.ozturk's user avatar
0 votes
1 answer
535 views

I don't want HSTS on port 8001 but on other ports

I have hsts set for my domain in Nginx.conf . It will redirect my website to https for main port 80. But I don't want the redirect to happen for my other port. How do I do this?
Marve's user avatar
  • 1
2 votes
1 answer
1k views

HSTS and Wordpress redirection to www and non-www and https - avoid multiple redirections?

I am trying to implement the HSTS (HTTP Strict Transport Security) on my Wordpress site, but I am not getting any success. First I had managed to redirect my site from non-www to www , and including ...
mlclm's user avatar
  • 169
0 votes
1 answer
2k views

Warning: Unnecessary HSTS header over HTTP

we would like to add the HSTS header to our page https://www.wipfelglueck.de Our page is running on a shared server, so we don't have access to the httpd.conf. We tried to enable this header via the ....
user3310735's user avatar
4 votes
1 answer
1k views

How can I apply HSTS header to all vhosts over 443 in Apache

I'm looking to add the HSTS header in Apache... # HSTS / Header Strict Transport Security Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" ... but ...
oucil's user avatar
  • 599
0 votes
1 answer
240 views

HSTS policy not preloaded on non www host

i am not very familiar with HSTS , but i try to implement it on my shared webhosting server. Seems i have gotten it to work on host with www. but not on apex host. Hardenize security audit flags it ...
user2033139's user avatar
-1 votes
2 answers
1k views

Apache redirect with HSTS

I need to redirect all for example.com to https://www.example.com with HSTS turned on. How to do it? I got configuration in vhost80 and vhost443. What to fix in this code: in vhost 80 RewriteCond %{...
Kamil Bu's user avatar
12 votes
1 answer
11k views

How to disable HSTS header in Apache 2.4? [closed]

I've set up a Vagrant box with Ubuntu 18.04 and installed Apache 2.4.29. I've created and enabled a new conf file that looks like this: <VirtualHost *:80> ServerName django.dev ...
simon's user avatar
  • 231
0 votes
1 answer
2k views

How to avoid HSTS error by hosts redirect with self-signed certificate? [closed]

I created this records in windows hosts file 127.0.0.1 a.domain.name 127.0.0.1 b.domain.name 127.0.0.1 c.domain.name where 127.0.0.1 - ip of my server [a,b,c].domain.name - domains wich from i ...
Dmytro Likhachev's user avatar
1 vote
1 answer
55 views

Nginx web server on VPS over HTTP - hsts

So I have been trying to serve a simple static web page over HTTP using Nginx 1.14.0 (Ubuntu). I am able to: curl the web page using both domain name and IP-address and find the web page in browser ...
Adam's user avatar
  • 21
2 votes
1 answer
2k views

How can I allow http when on a specific subdomain with nginx? (HSTS)

I am trying to test my site on a stage site before making it live. Obviously it doesn't have the same certificate. When I try to going in with the testing.domain.com subdomain, I get this error in ...
stackers's user avatar
  • 327
0 votes
0 answers
83 views

IMG loaded from HSTS domain on non-HTTPS site breaks site

Would HSTS cause an entire site (browser) to redirect to its HTTPS counterpart if a single (or more) resource from an HSTS domain was inserted into a HTTP site - e.g. through an 'img' tag? We have ...
Kinnectus's user avatar
  • 260
1 vote
1 answer
522 views

HTTP redirect (301, 302) with HSTS/.dev domain

I own a .dev domain, which is included on the HSTS preload list. The domain is registered with Namecheap. Now, when trying to set up redirects (301,302) from my www. to non-www, this is apparently ...
Thomas Kainrad's user avatar
2 votes
1 answer
2k views

nginx 1.15.10 - TLSv1.3 doesn't get applied despite the config

nginx -V nginx version: nginx/1.15.10 built by gcc 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) built with OpenSSL 1.1.0j 20 Nov 2018 (running with OpenSSL 1.1.1b 26 Feb 2019) TLS SNI support enabled ...
user avatar
1 vote
2 answers
2k views

nginx fails to send HSTS headers despite being configured to do so

I'm setting up a site for myself using nginx and letsencrypt, and I wanted to set up HSTS preloading for the added security benefits, however when I check the url with multiple different scanners, ...
pyr0ball's user avatar
0 votes
1 answer
4k views

SSLLabs: Strict Transport Security (HSTS): Server provided more than one HSTS header

CentOS 6.8 Apache 2.2 I have two websites running off this server (moodle and mahara). For some reason, the ssllabs tests come back fine for one of them (moodle) but for the mahara website, I get ...
CMR's user avatar
  • 133
1 vote
1 answer
457 views

HSTS issues when redirecting to www. sub domain

I am trying to setup HSTS for my website but running into some problems regarding HSTS and the use of the www. sub domain. What I would like is for all HTTP and HTTPS traffic to redirect to https://...
Ross Hodgman's user avatar
1 vote
1 answer
115 views

Nginx redirect to www

I have the same configuration on all my blocks yet only this one redirects to www while all my other redirects to non www. I think it may have to do something with the hsts that I've recently added ...
i6x86's user avatar
  • 111
2 votes
2 answers
9k views

Enable HTTP Strict Transport Header globally in HAProxy

I want to enable HTTP Strict Transport Security (HSTS) Headers globally for all my backends in HAProxy v1.5. Following the instructions from https://www.haproxy.com/blog/haproxy-and-http-strict-...
kenlukas's user avatar
  • 3,206
9 votes
1 answer
3k views

HSTS and double redirect

I manage a little website in a shared hosting LAMP environment: this basically means the only thing I can edit is an htaccess file. I wanted to add HSTS support (and I did it), but, when I tested my ...
user avatar
1 vote
2 answers
3k views

HSTS: Is includeSubDomains on main domain sufficient?

In my Plesk web admin edition I just activated HSTS on my main domain www.domain.tld with add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; The test on ssllabs.com ...
Sr. Schneider's user avatar
8 votes
3 answers
3k views

How does HSTS handle mixed content?

I've just checked with the SSL Server Test if I implemented the SSL certificate on my server correctly. I got a grade A in their ranking but you can get an A+ if you have activated HSTS. After some ...
Sr. Schneider's user avatar
1 vote
1 answer
902 views

Apache: HSTS redirection on non-standard HTTP port causes SSL error [duplicate]

I've read a few answers on SF, and I'm no closer to a solution. My problem seems a little specific... Customers were accessing a webserver on port 81. With the general trend towards HTTPS, the ...
Philip's user avatar
  • 650
3 votes
1 answer
887 views

Cloudflare: HSTS (Strict-Transport-Security) for subdomain only

I would like Cloudflare to send the HSTS header on the main domain, and on the www subdomain, but not the other subdomains. However I can only enable HSTS for the primary domain (and add ...
user643011's user avatar
0 votes
1 answer
4k views

Nginx - HSTS and Redirect non-www to www

I am checking the HSTS header here: https://hstspreload.org/ This is my non-www conf server { listen 443 server_name example.com; return 301 https://www.$server_name$request_uri; ##...
Arsh Dhillon's user avatar
0 votes
1 answer
2k views

how to disable HSTS in haproxy

I have a haproxy-ssl-terminated (haproxy 1.5.8 2014/10/31, debian jessie stock) test website, where the certificate expired. I'd like to be able to use the site while the new certificate arrives, but ...
P.Péter's user avatar
  • 629
1 vote
1 answer
2k views

How to configure HSTS redirect prerequisites using CloudFront?

The HSTS Preload List Submission website has very specific prerequisites which disallow combining protocol changes and redirects into one step (classic example - redirecting requests for http://...
Tom Brossman's user avatar
0 votes
0 answers
2k views

Force redirect to url with captive portal or dnsmasq

We are trying to host a static webpage (just one index.php) on a local wifi network without internet access. Essentially every user (mobile devices) should land on some landing page where he can ...
rex123's user avatar
  • 101
1 vote
0 answers
1k views

Using HSTS with Sub Domain Forwarding

Scanning a website using https://observatory.mozilla.org gives me the following error: Initial redirection from http to https is to a different host, preventing HSTS. Question Is this a genuine issue ...
JohnLBevan's user avatar
  • 1,310
0 votes
2 answers
613 views

Mitigating HSTS Bypass

Friends, Is there any way to prevent HSTS bypass on Apache/RHEL environment. I have a webserver with valid SSL certificate for the domain. Non HTTPS requests are being redirected to HTTPS. Necessary ...
Sam's user avatar
  • 11
0 votes
1 answer
1k views

HSTS with canonical URL redirect in nginx

I was using the nginx configuration taken from this post to implement redirect from http://(www.)example.com -> https://example.com: server { server_name www.example.com example.com; return ...
Heuriskos's user avatar
  • 168
12 votes
3 answers
6k views

hsts on main port 80, not on other ports

I have set hsts for my domain on the site http://server.mydom.tld:80, so the brower goes to port https://server.mydom.tld on port 443 However, I also have other webservers, running on other ports. So ...
Lenne's user avatar
  • 987
1 vote
1 answer
6k views

Using CNAME records to redirect to HTTPS when HSTS is active

We have a website running in HTTPS on the following URL: abc.example.com. The problem is that our client thought that any website URL should start with www and has printed www.abc.example.com on all ...
Zeep's user avatar
  • 107
2 votes
0 answers
4k views

How to configure HSTS in Wildfly the proper way?

I want to set the HSTS header on Wildfly. I haven't found any specific method to do this, so my first approach would be setting it manually via an undertow filter: <filters> <response-...
Demento's user avatar
  • 121
17 votes
3 answers
49k views

Adding HSTS to nginx config

I recently changed my nginx config to redirect all http traffic to https (and all www traffic to no-www). Would it make sense to also add add_header Strict-Transport-Security "max-age=31536000; ...
Hassan Baig's user avatar
  • 2,515
0 votes
3 answers
796 views

Ideally, how should HSTS / SSL Everywhere / Let's encrypt work with captive Wifi portals?

Some captive Wifi portals require the ability to 301/302 redirect a user to an authentication / terms of service page before permitting access to the Internet. This is at odds with SSL, which can't ...
makerofthings7's user avatar
0 votes
2 answers
521 views

HSTS secured domain migration

I bought a domain from a stranger and it seems like he protected the domain with HSTS-preloading. Is HSTS bound to the specific certificate which was used when HSTS was activated or can I just create ...
rockZ's user avatar
  • 115
4 votes
3 answers
8k views

How can I enable HSTS on the default Google Load Balancer coming with Google Container Engine?

I'd love to set up HSTS with my GKE cluster, as right now HTTP requests return a Google broken robot 404 page after setting this up in ingress.yml annotations: kubernetes.io/ingress.allow-http: "false"...
dain's user avatar
  • 165
0 votes
1 answer
520 views

Configure Apache to send HSTS header only in virtual hosts using HTTPS

We have an Apache 2.4 server that runs numerous virtual hosts, some of which use http and some of which use https. I would like to send the same HSTS (Strict-Transport-Security) header only in those ...
user35042's user avatar
  • 2,711
0 votes
1 answer
832 views

If I'm using HSTS on nginx, does the website force redirecting to HTTP?

I need to access some images and JS files through HTTP, but if I enable HSTS with add_header Strict-Transport-Security "max-age=31536000";, all files are served forcibly through HTTPS. So I used ...
Seo's user avatar
  • 1
4 votes
1 answer
3k views

Mikrotik - redirecting YouTube to a local friendly page

I'm configuring a rb750. I would like to drop YouTube access and redirect to a friendly page located in our local webserver. I can drop using l7 firewall but I'm not able to redirect user because ...
JefersonLemos's user avatar
1 vote
2 answers
2k views

hsts apache 2.4 not triggering?

I've set up Apache to use HSTS as follows just for testing and learning purposes only: /etc/apache2/sites-enabled/000-default.conf NameVirtualHost 192.168.3.55:80 NameVirtualHost 192.168.3.55:443 ...
jouell's user avatar
  • 621
1 vote
1 answer
350 views

Why must a HSTS header not be sent on HTTP

Why must a HSTS header not be sent on HTTP? What would it hurt; clients could take it as a hint to redirect to https.
Lenne's user avatar
  • 987
49 votes
9 answers
17k views

Is there any reason not to enforce HTTPS on a website?

A website I frequent have finally decided to enable TLS to their servers, only not to mandate it as a lot of websites out there do. The maintainer claims that TLS must be optional. Why? On my own ...
Maxthon Chan's user avatar
0 votes
1 answer
778 views

Point a subdomain to a separate IP address using DNS/nginx

I'm trying to point a subdomain to a different IP address on a different server, but for some reason it's only working every once in awhile (say 1 out of 20 times). Browsing to http//galera.domain.com ...
iisor's user avatar
  • 41