I have a website like https://www.example.com. I need to force all users visiting my site to use HTTPS connections.

I thought about HSTS but I don't know how to add my site to the preload entries of browsers (browsers will only allow HTTPS access to domains in their preload lists) in their next versions. Is there any site, or person, where I can register?

I know about it is possible to enforce HTTPS for a website manually to my browser, but I need my site to be "preloaded" for all users.

  • 1
    In the fact, https only config just make browser connection to my browser with https-only mode. But it isn't prevent user from MITM (Man in the middle) attack. I need my site to be in HSTS preload entries of famous browsers. – Andiana Jul 14 '16 at 2:31
  • Related posts from here and from Webmasters SE that cover policies regarding subdomains (in case it applies). – Jedi Jul 14 '16 at 2:58

All major browsers (Chrome, Firefox, Opera, Safari, IE 11 and Edge) use a HSTS preload list of Chromium.

You can check the eligibility and register the website to be included in the HSTS preload list on the https://hstspreload.appspot.com page.

As of today, the requirements are:

  1. Have a valid certificate.
  2. Redirect from HTTP to HTTPS on the same host.
  3. Serve all subdomains over HTTPS.
    • In particular, you must support HTTPS for the www subdomain if a DNS record for that subdomain exists.
  4. Serve an HSTS header on the base domain for HTTPS requests:
    • The max-age must be at least eighteen weeks (10886400 seconds).
    • The includeSubDomains directive must be specified.
    • The preload directive must be specified.
    • If you are serving an additional redirect from your HTTPS site, that redirect must still have the HSTS header (rather than the page it redirects to).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.