Is Your Site HSTS Enabled?

Re:Is Your Site HSTS Enabled? by abarth on Friday April 25, 2014 @11:53AM (#7647234)

I'd recommend starting out with a small max-age value so that any mistaken records will expire quickly. (Disclosure: I'm a co-editor of the HSTS RFC.)

[ Parent | on HN ]

Re:Is Your Site HSTS Enabled? by gellerb on Friday April 25, 2014 @12:03PM (#7647294)

Yeah. I noticed that paypal.com has a max-age of 4 hours.

[ Parent | on HN ]

Re:Is Your Site HSTS Enabled? by rhoml on Friday April 25, 2014 @01:06PM (#7647699)

Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.

[ Parent | on HN ]

Re:Is Your Site HSTS Enabled? by d0ugie on Friday April 25, 2014 @01:50PM (#7647980)

Is there any downside, when using SSL, in enabling perfect forward secrecy?

[ Parent | on HN ]

Re:Is Your Site HSTS Enabled? by JshWright on Friday April 25, 2014 @02:13PM (#7648145)

Make sure you're using an SSL library that support ECDHE cipher suites... the non EC suites are very slow.

[ Parent | on HN ]