• About
    • History of Dallas SEO
    • SEO Expert Witness
  • Contact
  • Topics
    • Bing
    • Blogging
    • Branding
    • Domain Names
    • Google
    • Internet Marketing
    • Link Building
    • Local Search
    • Marketing
    • Public Relations
    • Reputation Management
    • Search Engine Marketing
    • Search Engine Optimization
    • Search Engines
    • Social Media
    • Tech
  • Advertise
  • Email Newsletter

Bill Hartzer

Bill Hartzer on Search, Marketing, Tech, and Domains.

SEMrush

Home » Google » Moved To HTTPs? Get on the HSTS Preload List for Chrome

Moved To HTTPs? Get on the HSTS Preload List for Chrome

Posted on September 27, 2017 Written by Bill Hartzer

HSTS preload list

As you are well aware by now, I moved this site to HTTPs (a secure SSL site) back a few years ago when Google announced that HTTPs is, in fact, a search engine ranking factor. Google has announced that they’re making HSTS (HTTP Strict Transport Security) the default on all of the Google-owned TLDs, starting with .dev and .foo. This is really good news, as any domain name on those TLDs (Top Level Domains) will be secure and using HTTPs URLs.

Starting in October, Google Chrome will begin to show warnings to users that a website is not secure when they fill out a form on your website. Firefox already does this, but there’s an additional need to move your website to HTTPs immediately. If you haven’t moved your website to HTTPs yet, then contact me and I can help you move to HTTPs.

Google’s announcement on their blog announces the HSTS preload list:

Earlier this year we announced that Chrome will start displaying warnings on insecure sites, and we recently introduced fully managed SSL certificates in App Engine. And today we’re proud to announce that we are beginning to use another tool in our toolbox, the HTTPS Strict Transport Security HSTS preload list, in a new and more impactful way.

Well, in Google’s announcement, they also have set up a pre-load list for the Chrome web browser. That means that if your domain name complies with the necessary guidelines and requirements, then you can submit your domain name to the Chrome pre-load list. The domain names on this list are hard-coded into Google Chrome. This is something that you’ll want to do–which could be even more of a “trust signal” for Google. If I were Google, I would trust domain names on this list more than other domain names that are NOT on the list. But, that’s just me. I don’t know what Google is going to do.

So how do you get your domain name on the HSTS preload list so your domain name is hard-coded into Google Chrome? Here’s what you need to do:

  1. First, make sure your website is HTTPs and has a valid SSL certificate installed. If you’re wanting to do this on the cheap, then use a site like Cloudflare.com to cache your site and get your domain name a free SSL certificate.
  2. Go to https://hstspreload.org/ and check your domain name. If it’s valid, and set up properly, and meets the requirements, you’ll be able to agree to the terms, check the boxes, and submit your domain name.
  3. If you get a warning, then you’ll need to look at the warnings that you’re getting. The site should give you some indication of what you’ll need to do.

One of the warnings I received for my domain name was that the max-age wasn’t set up properly. There are a ways to deal with this: have your developer or web host fix the max-age setting on your site’s headers. If you’re comfortable enough, with editing your .htacess file (on a unix server) then you can add the max-age lines of code to the .htaccess file and you should be set to go.

Another option, which made it easy for me, was to set up HSTS on Cloudflare. I have a SSL certificate on my domain and on my host’s domain, and Cloudflare. I was able to go in and set up the HSTS properly so that it has the max-age setting as well as the other redirects required.

On Cloudflare, do this to set up the HSTS properly so that you can submit your domain to the HSTS preload list:

  1. Log into Cloudflare and select your domain.
  2. Select Crypto.
  3. On SSL, choose Full (strict).
  4. On Always Use HTTPs, turn it ON.
  5. On HTTP Strict Transport Security (HSTS), click Change HSTS Settings.
  6. Here’s what I have set for these settings:

    HSTS Cloudflare settings

    Status: On
    Max-Age: 12 months
    Include subdomains: On
    Preload: On
    No-sniff: On

  7. I also have “Automatic HTTPS Rewrites” turned ON, so that any requests to HTTP on my domain get redirected to HTTPs automatically.

Once you completed those steps on Cloudflare (assuming that you already have your domain set up there and you’re using it), then you should be able to immediately go on over to the preload website and submit your domain. When I did this, it immediately was accepted and went through.

As I mentioned, I recommend that you set up HSTS and make sure it’s set up properly by submitting it to the pre-load website. This way your domain name will be hard-coded into Google Chrome as one that is fully HTTPs.

Filed Under: Google

SEMrush

About Bill Hartzer

Bill Hartzer is CEO of Hartzer Consulting, LLC, an SEO Consulting firm that includes services such as search engine optimization, technical SEO audits, domain name consulting, and online reputation management.

Recent Posts

  • Someone Stole My Domain Name: Here’s What You Do January 4, 2023
  • Web Hosting Services Market to Grow to $254.86 Billion by 2029 December 13, 2022
  • This SEO Blog Post Was Written by ChatGPT December 8, 2022
  • Facebook Rolling Out Facebook Articles December 7, 2022
  • Doing SEO is Better Than… December 6, 2022
  • Tucows and GoDaddy Report Q3 2022 Results November 6, 2022
  • How to Measure App Events Sourced by Organic Search and SEO September 20, 2022
  • Google Allegedly Eavesdrops and Monitors the Brain 24 hours a Day to Control Humanity September 14, 2022
  • Why You Shouldn’t Hire SEOs Based on An Email September 13, 2022
  • Global SEO Market to Reach $122.11 Billion by 2028 September 9, 2022
  • Bluehost Launches New Commerce Solutions for WordPress September 8, 2022
  • Which CMS? How to Choose the Best CMS for Your Purposes August 29, 2022
  • Accidental SEO Manager: Interview with Ash Nallawalla August 15, 2022
  • Sometimes Google Isn’t Family Friendly August 1, 2022
  • Something’s Seriously Wrong with Facebook Notifications July 12, 2022
  • Facebook Internet Tracking Settlement June 24, 2022
  • RankSense Acquired by SEOClarity June 1, 2022
  • LinkedIn Links, Digital Marketing News, and SEO Questions Answered May 9, 2022
  • GoDaddy Ending Forwarding of Existing Shortened Links May 5, 2022
  • 7 Ways to Protect Your Domain Name March 31, 2022

US Agency Awards Judge

DFWSEM logo

Bill Hartzer is a Brand Ambassador for:



Industry Friends

I Love SEO
WTFSEO
SEO By the Sea
Jeff Lenney
Jeff Gabriel
Phil Drinkwater
Dixon Jones
Brian Hartzer
Navah Hopkins

Connect With Bill Hartzer

Bill Hartzer on Twitter
Bill Hartzer on Instagram
Hartzer Consulting on Facebook
Bill Hartzer on Facebook
Bill Hartzer on YouTube

Categories

  • Advertising (19)
  • Bing Search Engine (6)
  • Blogging (42)
  • Branding (12)
  • Domain Names (209)
  • Google (236)
  • Internet Marketing (25)
  • Internet Usage (85)
  • Link Building (53)
  • Local Search (39)
  • Marketing (180)
  • Marketing Foo (30)
  • Pay Per Click (3)
  • Podcast (18)
  • Public Relations (8)
  • Reputation Management (9)
  • Search Engine Marketing (44)
  • Search Engine Marketing Events (48)
  • Search Engine Marketing Firms (19)
  • Search Engine Marketing Jobs (33)
  • Search Engine Optimization (164)
  • Search Engines (204)
  • Social Media (192)
  • Tech (7)
  • Web Analytics (17)
  • Webinars (1)

Note: All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only, and are mentioned only to help my readers. All other trademarks cited herein are the property of their respective owners. Use of these names, logos, and brands does not imply endorsement.




Hartzer Consulting



Website, Content, and Marketing by Hartzer Consulting, LLC.

Copyright © 2023 ·