SSL

HSTS: HTTP Strict Transport Security, and why it’s good to have it

HSTS, or HTTP Strict Transport security is an option in Really Simple SSL pro, and I guess most people just activate it, just because you can. But it’s good to know why you need it.

When you have an SSL certificate on your domain, anyone can still use your site over http. The simplest solution is to add a redirect. That’s one of the features of Really Simple SSL: it adds a redirect to your site that forces it over SSL. But what if someone pretends to be your site: this can happen anywhere, and is simple to achieve: a user types in domain.com, but malicious software directs the request to a site pretending to be domain.com. Now the user is open to attacks.

HSTS: prevent http requests to your domain

That’s where HSTS, or HTTP Strict Transport security comes in. When this header is set on your domain, a browser will do all requests to your site over https from then on. So in the case where a hacker is redirecting this user to a fake domain.com, the browser remembers to use SSL because of the HSTS, so requests the secure site. But this doesn’t exist: no SSL certificate was authorized for this hacker’s fake site. As the browser needs to visit your site first to see this header, this will be active only after the first visit. To enable this feature, you can just enable the setting in settings/ssl (pro only).

HSTS preload list: preventing http requests on the first visit as well

As HSTS is only enforced after the browser visits your site, this is a vulnerability: if the user hasn’t visited your site before, HSTS won’t be set, so the visitor can still request the site over http. There is a solution for this: the HSTS preload list. This is a list of HSTS domains, that is preloaded in browsers. If you’re on the list, the browser will know that it should only load your site over https, even before it ever requests your site.

But be carefull with this feature: all subdomains (like sub.domain.com) will be forced over https as well, and removal from the preload list is very difficult, and might not propagate very fast. So even if you’re removed, browsers might have your site in the list for months yet.

With a few tweaks, you can configure your site for the preload list (this option will appear when HSTS is enabled).

Related Articles

  • Really Simple SSL 2.3.8

    Some small but important tweaks were added to the latest release of 2.3.8. In previous versions, javascript was used as fallback when .htaccess redirects were not possible. A much better...
  • Really Simple SSL 2.5.14, minor update

    2.5.14 was released today, with two adjustments: A bug was discovered in the mixed content fixer, where a match was found on http links across html elements when newlines were removed...
  • Version 2.2 released

    Yesterday the new version was released. With support for per site activation on WordPress multisite, easy uninstall option, and even less overhead on the front-end, which was pretty good already...
  • Support for recovery of Facebook likes in JetPack sharing

    Today, the Really Simple Social likes recovery plugin has added support for the recovery of Facebook likes with the JetPack sharing tool. If you are using JetPack with it’s in...