What is the best way to accomplish this and prevent attacks like SSL Strip?
closed as unclear what you're asking by TildalWave, Eric G, NULLZ, Gilles, AJ Henderson Apr 17 '14 at 13:19
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Train users to either always type
https:// for your site, follow links from a site like google (that has hard-coded
HSTS), or use a bookmark. (Do this training in addition to other sensible training policies: do not do security sensitive things on unsecured/public wifi or public computers, use strong passwords that aren't reused, etc.. Then try getting browser makers to hardcode your site into their preloaded HSTS only lists.
Really not much else you can do.
EDIT: I'm not 100% sure about the specifics of SSL-Strip, but according to some turning off port 80 (besides simply redirecting to https) will work to stop SSL Strip attacks. So it may be sensible, though you should acknowledge it is possible to go beyond SSLStrip to do a MitM attack against a site that serves HTTPS only, if you can trick the user into going to an HTTP site that points to a computer you control (e.g., after ARP spoofing) before they first connect. So turning off HTTP (port 80) or having only port 80 only send redirects to HTTPS (port 443) seems to be a sensible defensive move, you should be aware it does not prevent SSL striping attacks in general.
The only way is to not offer any sensible data (this includes login forms already) on port 80. This way the client must switch to https, either by hand or automatically through redirection etc.