SSL

HSTS: HTTP Strict Transport Security, and why it’s good to have it

HSTS, or HTTP Strict Transport security is an option in Really Simple SSL pro, and I guess most people just activate it, just because you can. But it’s good to know why you need it.

When you have an SSL certificate on your domain, anyone can still use your site over http. The simplest solution is to add a redirect. That’s one of the features of Really Simple SSL: it adds a redirect to your site that forces it over SSL. But what if someone pretends to be your site: this can happen anywhere, and is simple to achieve: a user types in domain.com, but malicious software directs the request to a site pretending to be domain.com. Now the user is open to attacks.

HSTS: prevent http requests to your domain

That’s where HSTS, or HTTP Strict Transport security comes in. When this header is set on your domain, a browser will do all requests to your site over https from then on. So in the case where a hacker is redirecting this user to a fake domain.com, the browser remembers to use SSL because of the HSTS, so requests the secure site. But this doesn’t exist: no SSL certificate was authorized for this hacker’s fake site. As the browser needs to visit your site first to see this header, this will be active only after the first visit. To enable this feature, you can just enable the setting in settings/ssl (pro only).

HSTS preload list: preventing http requests on the first visit as well

As HSTS is only enforced after the browser visits your site, this is a vulnerability: if the user hasn’t visited your site before, HSTS won’t be set, so the visitor can still request the site over http. There is a solution for this: the HSTS preload list. This is a list of HSTS domains, that is preloaded in browsers. If you’re on the list, the browser will know that it should only load your site over https, even before it ever requests your site.

But be carefull with this feature: all subdomains (like sub.domain.com) will be forced over https as well, and removal from the preload list is very difficult, and might not propagate very fast. So even if you’re removed, browsers might have your site in the list for months yet.

With a few tweaks, you can configure your site for the preload list (this option will appear when HSTS is enabled).

Related Articles

  • Really Simple Plugins takes over development for Zip Recipes!

    We have added a cool new plugin to the Really Simple Plugins family: Zip Recipes! The past two years the plugin was developed by Gezim, who has created great features,...
  • Is your website GDPR compliant?

    With the upcoming stricter privacy laws, GDPR, a lot of website owners are asking themselves if their site is ready for this new law. Right now we’re working on a...
  • Really Simple SSL 2.5.23

    WordPress 4.9 was released this week. So we tested with the new version last week. No compatiblity issues with WordPress 4.9 were found. Additionally, we’ve added a test for the...
  • Really Simple SSL 2.5.18 beta release

    2.5.18 is in beta, and can be tested! Please test this new version and let us know your experiences! Removed JetPack SSL fix, as it is now incorporated in JetPack....