• About
    • History of Dallas SEO
    • SEO Expert Witness Service
  • Contact
  • Topics
    • Bing
    • Blogging
    • Branding
    • Domain Names
    • Google
    • Internet Marketing
    • Link Building
    • Local Search
    • Marketing
    • Public Relations
    • Reputation Management
    • Search Engine Marketing
    • Search Engine Optimization
    • Search Engines
    • Social Media
    • Tech
  • Advertise
  • Email Newsletter

Bill Hartzer

Bill Hartzer on Search, Marketing, Tech, and Domains.

traffic analysis tools

Home » Google » Moved To HTTPs? Get on the HSTS Preload List for Chrome

Moved To HTTPs? Get on the HSTS Preload List for Chrome

Posted By Bill Hartzer on September 27, 2017at 7:31 pm

HSTS preload list

As you are well aware by now, I moved this site to HTTPs (a secure SSL site) back a few years ago when Google announced that HTTPs is, in fact, a search engine ranking factor. Google has announced that they’re making HSTS (HTTP Strict Transport Security) the default on all of the Google-owned TLDs, starting with .dev and .foo. This is really good news, as any domain name on those TLDs (Top Level Domains) will be secure and using HTTPs URLs.

Starting in October, Google Chrome will begin to show warnings to users that a website is not secure when they fill out a form on your website. Firefox already does this, but there’s an additional need to move your website to HTTPs immediately. If you haven’t moved your website to HTTPs yet, then contact me and I can help you move to HTTPs.

Google’s announcement on their blog announces the HSTS preload list:

Earlier this year we announced that Chrome will start displaying warnings on insecure sites, and we recently introduced fully managed SSL certificates in App Engine. And today we’re proud to announce that we are beginning to use another tool in our toolbox, the HTTPS Strict Transport Security HSTS preload list, in a new and more impactful way.

Well, in Google’s announcement, they also have set up a pre-load list for the Chrome web browser. That means that if your domain name complies with the necessary guidelines and requirements, then you can submit your domain name to the Chrome pre-load list. The domain names on this list are hard-coded into Google Chrome. This is something that you’ll want to do–which could be even more of a “trust signal” for Google. If I were Google, I would trust domain names on this list more than other domain names that are NOT on the list. But, that’s just me. I don’t know what Google is going to do.

So how do you get your domain name on the HSTS preload list so your domain name is hard-coded into Google Chrome? Here’s what you need to do:

  1. First, make sure your website is HTTPs and has a valid SSL certificate installed. If you’re wanting to do this on the cheap, then use a site like Cloudflare.com to cache your site and get your domain name a free SSL certificate.
  2. Go to https://hstspreload.org/ and check your domain name. If it’s valid, and set up properly, and meets the requirements, you’ll be able to agree to the terms, check the boxes, and submit your domain name.
  3. If you get a warning, then you’ll need to look at the warnings that you’re getting. The site should give you some indication of what you’ll need to do.

One of the warnings I received for my domain name was that the max-age wasn’t set up properly. There are a ways to deal with this: have your developer or web host fix the max-age setting on your site’s headers. If you’re comfortable enough, with editing your .htacess file (on a unix server) then you can add the max-age lines of code to the .htaccess file and you should be set to go.

Another option, which made it easy for me, was to set up HSTS on Cloudflare. I have a SSL certificate on my domain and on my host’s domain, and Cloudflare. I was able to go in and set up the HSTS properly so that it has the max-age setting as well as the other redirects required.

On Cloudflare, do this to set up the HSTS properly so that you can submit your domain to the HSTS preload list:

  1. Log into Cloudflare and select your domain.
  2. Select Crypto.
  3. On SSL, choose Full (strict).
  4. On Always Use HTTPs, turn it ON.
  5. On HTTP Strict Transport Security (HSTS), click Change HSTS Settings.
  6. Here’s what I have set for these settings:

    HSTS Cloudflare settings

    Status: On
    Max-Age: 12 months
    Include subdomains: On
    Preload: On
    No-sniff: On

  7. I also have “Automatic HTTPS Rewrites” turned ON, so that any requests to HTTP on my domain get redirected to HTTPs automatically.

Once you completed those steps on Cloudflare (assuming that you already have your domain set up there and you’re using it), then you should be able to immediately go on over to the preload website and submit your domain. When I did this, it immediately was accepted and went through.

As I mentioned, I recommend that you set up HSTS and make sure it’s set up properly by submitting it to the pre-load website. This way your domain name will be hard-coded into Google Chrome as one that is fully HTTPs.

Filed Under: Google

traffic analysis tools

Listen to "Digital Marketing with Bill Hartzer" on Spreaker.

About Bill Hartzer

Bill Hartzer is CEO of Hartzer Consulting, LLC, an SEO Consulting firm that includes services such as search engine optimization, technical SEO audits, domain name consulting, and online reputation management.

Recent Posts

  • RightoftheDot Live Online Domain Auction February 25 February 18, 2021
  • Jabez LeBret on Digital PR, Journalism, and Media Coverage February 5, 2021
  • Someone Stole My Domain Name: Here’s What You Do February 1, 2021
  • 23 Top Level Domains TLDs Up for Auction January 27, 2021
  • GotConn Privacy Search Engine Launches January 26, 2021
  • Andrew Muller on Testing Google Ads Using Facebook Ads January 15, 2021
  • Mike Rhodes from Web Savvy On Google Ads January 8, 2021
  • How to Opt Out of Google Analytics December 16, 2020
  • Majestic Just Changed SEO and Linking Forever December 15, 2020
  • Yext Consumer Search Trend Predictions for 2020 December 8, 2020
  • SearchBox Launches SearchAI SmartSuggest, SearchAI Answers and SearchAI Personalization December 7, 2020
  • Google Poly is Shutting Down December 2, 2020
  • Domain Name Brokers Put FFF.com and HHH.com Domains Up for Sale December 1, 2020
  • Google Webmaster Tools Moves Twitter Account November 11, 2020
  • Email Deliverability, Setting Up DMARC, DKIM, and SPF on Your Domain October 29, 2020
  • The Bing Search Engine is Now Microsoft Bing October 6, 2020
  • Beck Power on Building Authority on Social Media and Repurposing Content October 2, 2020
  • Naira Perez on Paid Media, and an Intro to Social Paid Media, and Audiences September 17, 2020
  • Fake Birth Date Used on Google and Apple Accounts Is on Credit Report August 17, 2020
  • What is Bill Hartzer Disease? July 20, 2020

DFWSEM logo

Bill Hartzer is a Brand Ambassador for:



Industry Friends

WTFSEO
SEO By the Sea
Jeff Lenney
Jeff Gabriel
Phil Drinkwater
Dixon Jones

Connect With Bill Hartzer

Bill Hartzer on Twitter
Bill Hartzer on Instagram
Hartzer Consulting on Facebook
Bill Hartzer on Facebook
Bill Hartzer on YouTube

Categories

  • Advertising (19)
  • Bing Search Engine (6)
  • Blogging (42)
  • Branding (12)
  • Domain Names (200)
  • Google (228)
  • Internet Marketing (24)
  • Internet Usage (84)
  • Link Building (52)
  • Local Search (38)
  • Marketing (176)
  • Marketing Foo (30)
  • Pay Per Click (1)
  • Podcast (9)
  • Public Relations (8)
  • Reputation Management (9)
  • Search Engine Marketing (44)
  • Search Engine Marketing Events (47)
  • Search Engine Marketing Firms (19)
  • Search Engine Marketing Jobs (33)
  • Search Engine Optimization (156)
  • Search Engines (203)
  • Social Media (187)
  • Tech (7)
  • Web Analytics (16)




Note: All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only, and are mentioned only to help my readers. All other trademarks cited herein are the property of their respective owners. Use of these names, logos, and brands does not imply endorsement.




Hartzer Consulting



Website, Content, and Marketing by Hartzer Consulting, LLC.

Copyright © 2021 by Bill Hartzer and Hartzer Consulting, LLC.

Disclaimer - Privacy Policy - Terms of Use
Go to mobile version