#hsts — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #hsts, aggregated by home.social.
-
Lock down your Nginx with HSTS preload and includeSubDomains. This snippet adds Strict-Transport-Security to all responses, forcing HTTPS-only browser behavior. Configure max-age and preload safely. Works on Nginx 1.9.5+ (Ubuntu 22.04, Debian 12, CentOS 9). #nginx #snippet #hsts #security-headers #ValtersIT
https://www.valtersit.com/vault/enforce-hsts-with-preload-and-includesubdomains-for-nginx-aba299/
-
Lock down your Nginx: enforce HSTS with max-age, includeSubDomains, and preload. Browsers auto-upgrade all HTTP to HTTPS for your domain and subdomains. Works on Nginx 1.9.0+ (Ubuntu 20.04+, Debian 11+, RHEL 8+). #https #hsts #snippet #ValtersIT
https://www.valtersit.com/vault/nginx-enforce-stricttransportsecurity-with-preload-and-subdo-324d15/
-
Secure your Nginx with HSTS preload and subdomain inheritance. This config sends Strict-Transport-Security: max-age=31536000; includeSubDomains; preload on all HTTPS responses. Works on Ubuntu 22.04, Debian 12, CentOS 9. #http #hsts #nginx
https://www.valtersit.com/vault/nginx-hsts-preload-configuration-with-subdomain-inheritance-e5fafa/
-
Enabled HSTS with includeSubDomains and preload.
The cost is real and one-way: every current and future subdomain must serve HTTPS or become unreachable. Removal from the preload list is in browser-release hands, not yours.
Accepted because the site is HTTPS-only by intent and Caddy provisions certs for every subdomain automatically via Let's Encrypt.
-
💡Denk mee en reageer op de consultatie van het aangepaste “Besluit beveiligde verbinding met overheidswebsites en -webapplicaties”: https://www.internetconsultatie.nl/verzamelbesluitdigitaleoverheid
📜In het herziene besluit op basis van de Wet digitale overheid wordt verwezen naar nieuwe versies van de TLS- en Webapplicatie-richtlijnen van @ncsc_nl. Reageer voor 6 jan, 2026.
Meer info over het huidige besluit: https://www.digitaleoverheid.nl/overzicht-van-alle-onderwerpen/wetgeving/wet-digitale-overheid/veelgestelde-vragen-verplichting-https-en-hsts-voor-overheidswebsites/
#beveiliging #websites #openstandaarden #HTTPS #HSTS -
@gelatin @wyatt Maybe I'm missing something. If an attacker on a coffee shop WLAN sniffs your session cookie for a forum, they can proceed to ruin your life by posting illegal material under your name. There used to be a browser extension called "Firesheep" that would snoop others' cookies for Facebook until Facebook went all HTTPS all the time.
-
tesla.com, spacex.com, and boringcompany.com are all not on the HSTS preload list.
it would be a total shame if someone in a privileged network position used this to start inserting content letting people know that the CEO of these companies is a fucking Nazi.
#hstspreloadlist #hsts #tesla #TeslaProtests #ElonMusk #doge
-
Aha, takže to je kvůli #HSTS a includeSubDomains.
https://www.rfc-editor.org/rfc/rfc6797#section-6.1.2Je fajn, když člověk u nějaké IT magie zjistí, proč se to chová, jak se to chová.
-
step 0: Have a domain with a "real" cert and a subdomain with a self-signed cert
step 1: accept self-signed cert in firefox on subdomain
step 2: activate HSTS on main domain
step 3: wonder why self-signed cert no longer accepted on subdomain :S -
Can anyone offer a guess as to why I'm getting an HSTS error only on one computer?
I've run all Windows updates and a full virus/malware scan, and still can't load hippyjo.com or idwerkz.com on my desktop machine, in any browser.
They load fine on my laptop and phone though.
I've cleared cache, DNS, for windows and Chrome, and Firefox.
SSL certificate is valid, though I am not certain my hosting service has configured everything else properly. But they seem to load fine on every device other than my desktop.
I've exhausted my brain - can't figure out why the problem is only on this machine.
Please and thank you in advance for any ideas of what might be going on.
#html #hsts #troubleshoot #weirdError -
Made my personal website get the maximum amount of points of Mozilla's HTTP Observatory. Now, my static site delivers content as securely as it possibly can. I highly recommend anyone with a personal website to tweak it along with their webserver so that it gets at least a hundred points on HTTP Observatory.
https://developer.mozilla.org/en-US/observatory
The least you can do is add your site to the HSTS Preload list (https://hstspreload.org/).#blog #personalwebsite #mozilla #mdn #http #caddyserver #hsts #webdev
-
It’s 2024 and certificate renewal is still an issue. (Love that they’ve enabled HSTS though.)
-
@[email protected] @[email protected] @[email protected] @[email protected] @[email protected] @[email protected] no every orgasm i have is a political statement
#honbeast #gorillamodding #blanchard #tttt #hsts #dahmer #trans2incel -
Took a shit the size of my forearm
#hsts #blanchard #t #malebrained #mtf #amab -
About to sign a contract with The Devil #hsts #webhosting #security
-
Here's a good explanation on what HSTS is and why it's important. https://www.maxivanov.io/http-strict-transport-security/ (there's a lot of bad explanations on the net)
I noticed the coolify.io website doesn't have these HSTS headers
-
Apparently Mozilla fixed the unreliability of #HSTS 5 months ago. My bug report was resolved as a result. That's great news!
As far as I know, the HSTS table can now hold up to 2048 entries. Only 0.1% of Firefox users use more than that.
Also, the implementation of nsIDataStorage seems to allow additional temporary data, so even more values could be stored. However, I didn't really understand how this works.
-
secure your #wordpress site with #http #headers content-security policy #csp cross origin embedder policy #coep cross origin opener policy #coop cross origin resource policy #corp referrer policy http strict transport security #hsts permission policy and others: https://jornfranke.codeberg.page/technology-tutorials/wordpress-csp/
-
Update: it appears to be fixed now. #authentik #ssl #netlify #hsts
-
Trying to read about Authentik, but the website certificate on goauthentik.io has the wrong host, and HSTS means you can't access it with an invalid certificate.
Try to report it to the team and can only find a "join our Discord" link, except its not an invite link it's a link to the website which (if it was working) might redirect me there.
I guess I don't get to learn about Authentik today. #authentik #ssl #netlify #hsts
