Secure first HTTP request – SEO

Short answer :

• Use HSTS Preload : https://hstspreload.appspot.com/
• On https, always sent the HSTS header
• On http, always sent a 301 redirect to https

It will protect your visitors even for the first visit thanks to the preload : browsers will know your domain must be contacted only with https even before the first contact (it will be in their source code, see https://github.com/ssllabs/research/wiki/Preload-Lists ).

(and of course, keep your 301 redirect http=>https)

Why closing the port 80 is not a good idea ? Let’s see the two options :

Options with HSTS and the port 80 closed :

• First visit on http://example.com : Nothing happens

• subsequent visits on http://example.com : Nothing happens

• First visit on https://example.com : User is secure and HSTS is kept

• subsequent visits on http://example.com or https://example.com : User is secure (visits on http gets redirected thanks to HSTS)

In case of an attack :

• First visit on http://example.com : Get hacked (the hacker can forge an answer even if your server doesn’t respond)
• subsequent visits on http://example.com : Get hacked too (the user can be tricked to click on an http link to your website)
• First visit on https://example.com : User is secure
• subsequent visits on http://example.com or https://example.com : User is secure (visits on http gets redirected thanks to HSTS)

Options with HSTS and the port 80 open :

• First visit** on http://example.com : 301 redirect to https (and then gets HSTS)

• subsequent visits on http://example.com : User is securely redirect to https (thanks to HSTS)

• First visit on https://example.com : User is secure and HSTS is kept

• subsequent visits on http://example.com or https://example.com : User is secure (visits on http gets redirected thanks to HSTS)

In case of an attack :

• First visit on http://example.com : Get hacked

• subsequent visits on http://example.com : User is securely redirect to https (thanks to HSTS)

• First visit on https://example.com : User is secure and HSTS is kept

• subsequent visits on http://example.com or https://example.com : User is secure (visits on http gets redirected thanks to HSTS)

As you can see, opening the port 80 to answer a 301 redirect to https can improve a little the security (and closing it will not improve it, and will probably confused your visitors)