This repository has been archived by the owner on Nov 25, 2023. It is now read-only.

HTTPS only #50

Open

mozfreddyb opened this issue May 13, 2019 · 0 comments

mozfreddyb commented May 13, 2019

There are some security risks with allowing your website to just work on plain HTTP.
I recommend you configure encrypt.to that it

responds to HTTP requests with redirects to https://encrypt.to
sets the Strict-Transport-Security header, so that the browser will remember to prefer HTTPS
uses secure cookies

As a benefit, you might be able to work yourself up in bad rating you currently get at https://observatory.mozilla.org/analyze/encrypt.to

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.