HSTS, staged: 5 minutes, then a week, then a year issue #231 closed: completed andymccall opened this · 0 comments
andymccall set labels security ·
closed by change 2cbf6f348595 ·
andymccall set labels security ·
closed by change 2cbf6f348595 ·
Andy agreed (2026-10-16) to send Strict-Transport-Security from the hub, staged: max-age=300 first, a week after a few quiet days, then a year; includeSubDomains only once every subdomain is HTTPS; preload last. A [server] hsts_max_age setting (0 = off) so each step is a config change, with a test.