2026-11-08 · Daily security tips

Does your site tell browsers to stick to HTTPS?

HTTPS alone is not quite enough. If someone types yourapp.com, the first request can go over plain HTTP before the redirect, and on a hostile network that request can be intercepted. The Strict-Transport-Security (HSTS) header tells the browser to use HTTPS only for your domain from then on.

Check: run curl -sI https://yourapp.com and look for strict-transport-security. Some hosts add it for you, others don't, so check your custom domain, not just the default one.

Fix: send Strict-Transport-Security: max-age=31536000; includeSubDomains from your host or framework headers config. Only add preload once every subdomain serves HTTPS, because it is hard to undo.