Lessons

Strict-https header for increased security

Even if you opened the page using an encrypted channel, you can still send a request over an open connection that can be intercepted. Sensitive data, such as cookies, is transmitted along with this request.

To exclude any possibility of sending data over an unencrypted connection, you need to send instructions to the user’s browser via the Strict-https header to force only the encrypted connection to be used. So, you will protect users of your site from a whole family of cyber attacks.

In nginx, sending the header is configured:

add_header Strict-Transport-Security "max-age=31536000;includeSubDomains" always;

In Apache:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

More details on how to improve the security of Nginx and Apache servers.

PRO subscription for working with the service

Promo
Checking 50 pages in the tool "Checking the page"
190 ₽
The subscription is activated for 10 days and is linked to a specific site.
PRO subscription
3,500 pages per week in tools "Checking the page" and "Full site scan".
1 580 ₽
The subscription is activated for 30 days and you can scan any site.
Wallet
Additional pages that are credited to a separate balance. For checking large sites.
200 ₽
Number of pages
An active PRO subscription is required.
We use cookies. By continuing to use the site, you agree to the processing of personal data in accordance with privacy policy. I agree