HTTPS, HSTS and SSL Certificates: Upgrade your Website Security

What is an SSL certificate?

An SSL (Secure Socket Layer) certificate plays a crucial role in establishing secure and encrypted communication between a user’s browser and a website’s server. It authenticates the identity of the website, ensuring users connect to the intended and legitimate site, and enables encryption to safeguard sensitive information during transmission. Additionally, the certificate contributes to data integrity by preventing tampering or alteration of information in transit. Visual cues such as a padlock icon in the browser’s address bar or a URL starting with “https://” signify the presence of SSL certificates, instilling trust and confidence in users and indicating a secure online connection. Trusted Certificate Authorities (CAs) issue these certificates, and website owners install them on their servers to enhance security, especially for websites handling confidential data like login credentials or conducting financial transactions.

How to redirect http to https

To redirect HTTP to HTTPS, configure your web server to automatically forward users from the non-secure (HTTP) version of your website to the secure (HTTPS) version. The specific steps may vary depending on the web server software you are using. Here are general instructions for some common web servers (always backup your configuration files before making changes):

Apache Web Server:

1. Open your Apache configuration file. This file is often named httpd.conf or apache2.conf.
2. Locate the Virtual Host configuration for your website.
3. Add the following lines to redirect HTTP to HTTPS:
   <VirtualHost *:80>
ServerName yourdomain.com
Redirect permanent / https://yourdomain.com/
</VirtualHost>


   Replace yourdomain.com with your actual domain.

4. Save the changes and restart the Apache server.

Nginx Web Server:

1. Open your Nginx configuration file. This file is often named nginx.conf or is located in the /etc/nginx/sites-available/ directory.
2. Locate the server block for your website.
3. Add the following lines to redirect HTTP to HTTPS:
   server {
listen 80;
server_name yourdomain.com;
return 301 https://$host$request_uri;
}


   Replace yourdomain.com with your actual domain.

4. Save the changes and restart the Nginx server.

Microsoft IIS:

1. Open IIS Manager on your Windows server.
2. Select the site you want to configure.
3. In the Actions pane, click on “HTTP Redirect.”
4. Check the box for “Redirect requests to this destination” and enter https://yourdomain.com/ in the box.
5. Ensure the boxes for “Redirect all requests to exact destination” and “Only redirect requests to content in this directory (not subdirectories)” are checked.
6. Click “Apply” to save the changes.

How to implement HSTS Headers

Implementing HSTS involves configuring your web server to include the HSTS header in its responses. Here’s a general guide on how to implement HSTS on a variety of servers and hosting providers:

Apache Web Server:

1. Enable the mod_headers module: Make sure that the mod_headers module is enabled in your Apache server.
   sudo a2enmod headers
sudo systemctl restart apache2
2. Configure HSTS: Edit your Apache configuration file (usually located in /etc/apache2/sites-available/ or /etc/httpd/conf.d/). Add the following lines within the <VirtualHost> section for your domain:
   <VirtualHost *:443>
# ... other configurations ...Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</VirtualHost>

   • max-age: The time, in seconds, that the browser should remember to only access the site over HTTPS (one year in the example).
   • includeSubDomains: Optional, enforces HSTS for all subdomains.
   • preload: Optional, indicates that the domain should be included in the HSTS preload list.
3. Restart Apache: After making changes, restart Apache to apply the configuration.
   sudo systemctl restart apache2

Nginx Web Server:

1. Configure HSTS: Edit your Nginx configuration file (usually located in /etc/nginx/sites-available/ or /etc/nginx/conf.d/). Add the following lines within the server block for your domain:
   server {
listen 443 ssl;
# ... other configurations ...add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
}
   • max-age, includeSubDomains, and preload have the same meanings as in Apache.
2. Restart Nginx: After making changes, restart Nginx to apply the configuration.
   sudo systemctl restart nginx

WP Engine:

1. Login to WP Engine and go to Web Rules.
2. Click Enable Web Rules (if not already enabled) then select Header Rules.
3. Set the following values:
   • Action: Set
   • Name: Strict-Transport-Security
   • Value: max-age=31536000; includeSubDomains; preload
   • When: Only on Successes (2xx status codes)

Testing:

After implementing HSTS, you can check whether it’s working by visiting your site and checking the response headers using browser developer tools or online tools like SecurityHeaders.com. You should see the Strict-Transport-Security header with the specified values.

Note: Before enabling HSTS, ensure that your website works correctly over HTTPS, as HSTS enforces HTTPS for the specified duration, and browsers will remember this policy.