I have this very large and complex server application that amongst the numerous opensource tools that are baked into it, CouchDB 3.3.3 is one of them. "Baked" is important because what the vendor does is bake a stripped-down version of…
I have a website where the user can make unlimited subdomains for that website. One of our customers wants us to have HSTS enabled on the header so I added the following rule to my .htaccess: Header set Strict-Transport-Security "max-age=63072000;…
I have a Wordpress blog that is hosted on VPS using LEMP Stack (on Ubuntu 20.04). The domain (underthesun.dev) is already matched to VPS server (FTP and ping is ok, so DNS records are seem to be correct), but there…
I would like to prevent users accessing my website using http. Instead, I want to enforce the use of https. Usually, I have my websites hosted at providers who simply have a checkbox "Enforce https". In this case, I have…
I intend to HSTS preload a site, and have see the following header. No problem. It works. Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS A condition of HSTS preloading is that I also redirect all HTTP traffic to HTTPS. To…
I am currently doing some debugging on my website which involves calling the facebook API. I've installed dnsmasq to work with my mac os X to redirect all request to facebook.com to 127.0.0.1 I have a echo server which will…
I'm building Web site, and wondering how I can assure that it is secure if first request is made by HTTP. HSTS do this but partially. I think not opening HTTP port solve this problem. But is this standard? My…