A header that eliminates the insecure first request.
WHAT IT DOES
HTTP Strict Transport Security tells a browser to use https for your domain for a stated period, without asking. The browser then refuses to make an insecure request at all, even if a visitor types http.
WHY IT HELPS
Your redirect protects visitors only after an insecure request has already been made. HSTS removes that first request.
ENABLING IT
Add to .htaccess:
Header always set Strict-Transport-Security "max-age=31536000"
THE CAUTION
Once a browser has recorded the policy, it will not connect to your domain over http for the stated period. If your certificate later fails, visitors cannot reach the site at all and cannot click past the warning.
Start with a short max-age, such as 300, confirm everything works, then increase it.
INCLUDESUBDOMAINS
Extends the policy to every subdomain. Only add it once every subdomain reliably has a valid certificate.
PRELOADING
Submitting your domain to browser preload lists is effectively permanent. Do not do it without understanding the commitment.
