In this article I will talk about a very specific issue that might happen when using HSTS on a HTTPS-enabled website which gets the SSL certificate removed, thus reverting back to HTTP. HSTS is an effective countermeasure for man-in-the-middle attacks and is one of the most important HTTP Security Headers that any decent publicly-facing web site should be equipped with: if you want to know more about these headers – and/or require instructions on how to implement them in Nginx, Apache and/or IIS – I strongly suggest to read this post. Strict - Transport - Security : max - age = 31536000Īs you can see, the above header would instruct the browser to allow only HTTPS requests for that domain for the next year (max-age is specified in seconds 31,536,000 is equal to one non-leap year).
