SSL

HSTS: HTTP Strict Transport Security, and why it’s good to have it

HSTS, or HTTP Strict Transport security is an option in Really Simple SSL pro, and I guess most people just activate it, just because you can. But it’s good to know why you need it.

When you have an SSL certificate on your domain, anyone can still use your site over http. The simplest solution is to add a redirect. That’s one of the features of Really Simple SSL: it adds a redirect to your site that forces it over SSL. But what if someone pretends to be your site: this can happen anywhere, and is simple to achieve: a user types in domain.com, but malicious software directs the request to a site pretending to be domain.com. Now the user is open to attacks.

HSTS: prevent http requests to your domain

That’s where HSTS, or HTTP Strict Transport security comes in. When this header is set on your domain, a browser will do all requests to your site over https from then on. So in the case where a hacker is redirecting this user to a fake domain.com, the browser remembers to use SSL because of the HSTS, so requests the secure site. But this doesn’t exist: no SSL certificate was authorized for this hacker’s fake site. As the browser needs to visit your site first to see this header, this will be active only after the first visit. To enable this feature, you can just enable the setting in settings/ssl (pro only).

HSTS preload list: preventing http requests on the first visit as well

As HSTS is only enforced after the browser visits your site, this is a vulnerability: if the user hasn’t visited your site before, HSTS won’t be set, so the visitor can still request the site over http. There is a solution for this: the HSTS preload list. This is a list of HSTS domains, that is preloaded in browsers. If you’re on the list, the browser will know that it should only load your site over https, even before it ever requests your site.

But be carefull with this feature: all subdomains (like sub.domain.com) will be forced over https as well, and removal from the preload list is very difficult, and might not propagate very fast. So even if you’re removed, browsers might have your site in the list for months yet.

With a few tweaks, you can configure your site for the preload list (this option will appear when HSTS is enabled).

Related Articles

  • Really Simple SSL passing 800000 active websites!

    Really Simple SSL has passed 800 000 active installs last week, one million is coming closer! One of the reasons Really Simple SSL has been able to grow so fast,...
  • Really Simple SSL 2.4 released

    Today the 2.4 version is released. The mixed content fixer has been rebuilt, which should make it work in almost all situations. The marker which makes it possible for the...
  • Really Simple SSL Social 3.0

    Recently Really Simple SSL Social 3.0 has been released. The changes that have been made in version 3.0 have to do with the look and feel of the built-in sharing...
  • Really Simple SSL 2.5.24 – minor multisite fix

    Today Really Simple SSL 2.5.24 was released. Apart from the renaming of a css class, there was only one important change, and this one affecting only sites which: are multisite...