Against what types of attacks does HSTS protect my website?<\/h2>\n\n\n\n
HTTP Strict Transport Security (HSTS)<\/strong> mainly protects your website against man-in-the-middle (MiTM) attacks, cookie hijacking (also called session hijacking), and protocol downgrade attacks. <\/p>\n\n\n\n Man-in-the-middle attacks<\/strong>, or MiTM attacks for short, is a general term for when an unauthorized actor positions himself\/herself in a conversation between a user and an application. These attacks allow perpetrators to intercept confidential data and insert malicious data and links in a way indistinguishable from legitimate data. Enabling HTTP Strict Transport Security (HSTS)<\/strong><\/a> is a simple way to add another security layer to your website, especially if it is one which somehow collects sensitive information. Of course, you need to issue and install an SSL certificate<\/a> for your domain name first. Then you just need to add a few lines to the .htaccess file located in your website's document root. <\/p>\n\n\n\n To summarize, the main requirements of HSTS are:<\/p>\n\n\n\n To enable HSTS for your website and set up a redirect from non-www to www at the same time, add the following lines to your .htaccess file (the order of the lines is important):<\/p>\n\n\n\n If you prefer using non-www URLs instead of www, you can add the following lines instead:<\/p>\n\n\n\n When redirecting from www to non-www URLs, make sure to replace your-domain-name.com <\/strong>with your actual domain name. A key downside of using HSTS is that a visitor who cannot connect through HTTPS will be unable to view and use the website. Additionally, as \"HTTP Strict-Transport-Security\" is a response header, it requires the user agent to first visit the website to learn that it uses HSTS.\u00a0This means that the initial request remains unprotected from attacks if it uses an unsecure protocol such as plain HTTP, or if the URI for the initial request is obtained over an unencrypted channel. \u00a0Also, the HSTS header is ignored by the browser if the page is served over HTTP, which is why it is important to automatically redirect every HTTP request to HTTPS.<\/p>\n\n\n\n The solution to the unprotected initial request is Chrome's HTTP Strict Transport Security (HSTS) Preload list<\/a>. All major browsers enforce secure connections to domains included in the preload list, leaving HTTP requests a relic of the past. This list is managed by Google. If you want to add your website to the HSTS preload list, you can do so via the hstspreload.org<\/a> website. As described there, you should keep in mind that there are certain submission requirements, and your website should continue to satisfy them at all times. Otherwise, your website may be removed automatically from the list for failing to meet the requirements.<\/p>\n\n\n\n Don't request inclusion unless you're sure that you can support HTTPS for your entire site and all its subdomains<\/strong> in the long term. If you cannot have all applications on your primary domain and its subdomains working fully over HTTPS, then you should not submit your domain name to the HSTS Preload list, and you should not include the preload directive by default<\/strong> in your .htaccess file, as this could in time automatically add your website to the HSTS Preload list.<\/p>\n\n\n\n The security of your website should be of utmost importance to you, because you must protect your visitors and users and not put their data at risk. In addition to HTTPS and HSTS, there are additional headers you could add to your setup, and certain methods you could remove from the configuration of the web server, so a higher level of security is in place. We will write about this in one of our next posts.<\/p>\n","protected":false},"excerpt":{"rendered":" If you are concerned about the security of your website, you would want your visitors to always visit it via HTTPS. Although simple HTTP to HTTPS redirects do work most of the time, there are certain type of cyberattacks which may be able to bypass such redirects and trick your visitors into willingly giving away<\/p>\n","protected":false},"author":1,"featured_media":11708,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","footnotes":""},"categories":[6],"tags":[],"class_list":{"0":"post-11687","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security"},"author_meta":{"display_name":"ICDSoft","author_link":"https:\/\/www.icdsoft.com\/blog\/author\/icdsoft\/"},"featured_img":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/03\/HTTP-Strict-Transport-Security-HSTS-300x150.webp","featured_image_src":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/03\/HTTP-Strict-Transport-Security-HSTS.webp","featured_image_src_square":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/03\/HTTP-Strict-Transport-Security-HSTS.webp","author_info":{"display_name":"ICDSoft","author_link":"https:\/\/www.icdsoft.com\/blog\/author\/icdsoft\/"},"coauthors":[],"tax_additional":{"categories":{"linked":["Security<\/a>"],"unlinked":["Security<\/span>"]}},"comment_count":"0","relative_dates":{"created":"Posted 3 years ago","modified":"Updated 3 years ago"},"absolute_dates":{"created":"Posted on March 4, 2023","modified":"Updated on March 8, 2023"},"absolute_dates_time":{"created":"Posted on March 4, 2023 8:21 pm","modified":"Updated on March 8, 2023 5:29 am"},"featured_img_caption":"","series_order":"","_links":{"self":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/comments?post=11687"}],"version-history":[{"count":17,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11687\/revisions"}],"predecessor-version":[{"id":11720,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11687\/revisions\/11720"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/media\/11708"}],"wp:attachment":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/media?parent=11687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/categories?post=11687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/tags?post=11687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Let's imagine you are in a restaurant, and you connect to one of the available Wi-Fi hotspots listed on your laptop or smartphone. You decide to check a bank statement, so you visit your online banking page. Little do you know that the access point to which you are connected is a hacker\u2019s device. They are intercepting your initial HTTP request and then redirecting you to a clone login page which looks exactly like the real login page of your bank. This is known as an SSL stripping attack<\/strong>. The hacker establishes their own HTTPS connection to the bank's website (posing as the user) and maintains the HTTP connection with the user (posing as the bank's website). When you attempt to log in with your real username and password, your private data is exposed to the hacker and captured. Before entering any sensitive data on a website, we would highly recommend that you make sure that there's a padlock in the URL bar, showing that the connection is indeed secure. At this point, using Two-Factor Authentication (2FA) <\/a>for your Internet banking may seem like a very important thing. <\/p>\n\n\n\n
There are different types of session hijacking<\/strong>, but they all generally involve guessing or intercepting an existing session cookie, or tricking the user into signing in with a session ID created by the attacker. If you are connected to an unsecured Wi-Fi, a criminal could utilize a \"packet sniffing\" tool to monitor your network traffic and steal your session.
Another example would be for you to receive an email with a link to a login form for the website the attacker wants to access. The email looks similar to legitimate ones you have received in the past, so you log in with the phony session ID, giving the attacker a way in the door. Usually, such scam emails have a tell - the layout of the message could be a bit disrupted and there could be serious spelling or grammar errors. Also, the headers of the email can usually reveal whether the message was sent from an unauthorized outgoing mail server.
There are many other similar examples, so you should definitely be vigilant when entering any sensitive data on websites, even trusted ones.<\/p>\n\n\n\n![\"The](\"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/03\/secure-with-locks-1024x683.jpg\")
<\/figure>\n\n\n\nHow can I protect my website visitors?<\/h2>\n\n\n\n
\n
RewriteEngine On\n\n# Set HSTS env var only if HTTPS\nRewriteCond %{HTTPS} on\nRewriteRule ^ - [E=HSTS:1]\n\n# Redirect HTTP to HTTPS on the same host\nRewriteCond %{HTTPS} !=on\nRewriteRule ^ https:\/\/%{HTTP_HOST}%{REQUEST_URI} [R=301,L]\n\n# Redirect non-www to www (HTTPS only)\nRewriteCond %{HTTP_HOST} !^www\\.\nRewriteRule ^ https:\/\/www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]\n\n# Set HSTS header for 365 days including subdomains conditionally if request is over HTTPS only (based on HSTS env var)\nHeader always set Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" env=HSTS<\/code><\/pre>\n\n\n\nRewriteEngine On\n\n# Set HSTS env var only if HTTPS\nRewriteCond %{HTTPS} on\nRewriteRule ^ - [E=HSTS:1]\n\n# Redirect HTTP to HTTPS on the same host\nRewriteCond %{HTTPS} !=on\nRewriteRule ^ https:\/\/%{HTTP_HOST}%{REQUEST_URI} [R=301,L]\n\n# Redirect www to non-www (HTTPS only)\nRewriteCond %{HTTP_HOST} ^www\\.\nRewriteRule ^ https:\/\/your-domain-name.com%{REQUEST_URI} [R=301,L]\n\n# Set HSTS header for 365 days including subdomains conditionally if request is over HTTPS only (based on HSTS env var)\nHeader always set Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" env=HSTS<\/code><\/pre>\n\n\n\n
Detailed instructions for setting this up on the ICDSoft servers can be found in the \"How to enable HSTS?<\/strong><\/a>\" knowledge base article, where additional information about avoiding certain configuration conflicts is also available.<\/p>\n\n\n\nLimitations of HSTS<\/h2>\n\n\n\n
A way around the limitations (the HSTS Preload list)<\/h2>\n\n\n\n
Header always set Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload<\/s>\" env=HSTS<\/code><\/pre>\n\n\n\nIn conclusion<\/h2>\n\n\n\n