Lessons

Strict-https header for increased security

Even if you opened the page using an encrypted channel, you can still send a request over an open connection that can be intercepted. Sensitive data, such as cookies, is transmitted along with this request.

To exclude any possibility of sending data over an unencrypted connection, you need to send instructions to the user’s browser via the Strict-https header to force only the encrypted connection to be used. So, you will protect users of your site from a whole family of cyber attacks.

In nginx, sending the header is configured:

add_header Strict-Transport-Security "max-age=31536000;includeSubDomains" always;

In Apache:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

More details on how to improve the security of Nginx and Apache servers.

Tariff plans for working with the service

We use cookies. By continuing to use the site, you agree to the processing of personal data in accordance with privacy policy. I agree