I read recently that HSTS can cause problems with site access. Under what circumstances might that happen and what are safe HSTS settings to implement on my web server?
I read recently that HSTS can cause problems with site access.
Yes, HSTS can lock visitors out.
Note that a misconfiguration of HSTS is less likely and serious than for HTTP Pulic Key Pinning (HPKP), which it's often confused with. HPKP can be tricky to implement because it requires you to work with public keys, whereas setting up HSTS is quite straightforward.
To recap, what the HSTS header does is to instruct clients (browsers) that they may only access your site over HTTPS in the future (for a specified time) and not attempt any plain HTTP connection.
In these situations you should be careful with HSTS:
You don't know how long you will support HTTPS in the future. If you send a HSTS header with a high
max-ageand switch back to HTTP during that time, you risk locking out previous visitors. That's because if their browser has seen the header earlier, it will block all attempts of a plain HTTP connection until expiry.
You need to maintain some plain HTTP access, particularly on subdomains. Here you should make sure you don't set the header's
includeSubDomainsflag. Otherwise, you deny HTTP access for all subdomains as well.