• About
    • History of Dallas SEO
    • SEO Expert Witness Service
  • Contact
  • Topics
    • Bing
    • Blogging
    • Branding
    • Domain Names
    • Google
    • Internet Marketing
    • Link Building
    • Local Search
    • Marketing
    • Public Relations
    • Reputation Management
    • Search Engine Marketing
    • Search Engine Optimization
    • Search Engines
    • Social Media
    • Tech
  • Advertise
  • Email Newsletter

Bill Hartzer

Bill Hartzer on Search, Marketing, Tech, and Domains.

SEMrush

Home » Google » Moved To HTTPs? Get on the HSTS Preload List for Chrome

Moved To HTTPs? Get on the HSTS Preload List for Chrome

Posted By Bill Hartzer on September 27, 2017at 7:31 pm

HSTS preload list

As you are well aware by now, I moved this site to HTTPs (a secure SSL site) back a few years ago when Google announced that HTTPs is, in fact, a search engine ranking factor. Google has announced that they’re making HSTS (HTTP Strict Transport Security) the default on all of the Google-owned TLDs, starting with .dev and .foo. This is really good news, as any domain name on those TLDs (Top Level Domains) will be secure and using HTTPs URLs.

Starting in October, Google Chrome will begin to show warnings to users that a website is not secure when they fill out a form on your website. Firefox already does this, but there’s an additional need to move your website to HTTPs immediately. If you haven’t moved your website to HTTPs yet, then contact me and I can help you move to HTTPs.

Google’s announcement on their blog announces the HSTS preload list:

Earlier this year we announced that Chrome will start displaying warnings on insecure sites, and we recently introduced fully managed SSL certificates in App Engine. And today we’re proud to announce that we are beginning to use another tool in our toolbox, the HTTPS Strict Transport Security HSTS preload list, in a new and more impactful way.

Well, in Google’s announcement, they also have set up a pre-load list for the Chrome web browser. That means that if your domain name complies with the necessary guidelines and requirements, then you can submit your domain name to the Chrome pre-load list. The domain names on this list are hard-coded into Google Chrome. This is something that you’ll want to do–which could be even more of a “trust signal” for Google. If I were Google, I would trust domain names on this list more than other domain names that are NOT on the list. But, that’s just me. I don’t know what Google is going to do.

So how do you get your domain name on the HSTS preload list so your domain name is hard-coded into Google Chrome? Here’s what you need to do:

  1. First, make sure your website is HTTPs and has a valid SSL certificate installed. If you’re wanting to do this on the cheap, then use a site like Cloudflare.com to cache your site and get your domain name a free SSL certificate.
  2. Go to https://hstspreload.org/ and check your domain name. If it’s valid, and set up properly, and meets the requirements, you’ll be able to agree to the terms, check the boxes, and submit your domain name.
  3. If you get a warning, then you’ll need to look at the warnings that you’re getting. The site should give you some indication of what you’ll need to do.

One of the warnings I received for my domain name was that the max-age wasn’t set up properly. There are a ways to deal with this: have your developer or web host fix the max-age setting on your site’s headers. If you’re comfortable enough, with editing your .htacess file (on a unix server) then you can add the max-age lines of code to the .htaccess file and you should be set to go.

Another option, which made it easy for me, was to set up HSTS on Cloudflare. I have a SSL certificate on my domain and on my host’s domain, and Cloudflare. I was able to go in and set up the HSTS properly so that it has the max-age setting as well as the other redirects required.

On Cloudflare, do this to set up the HSTS properly so that you can submit your domain to the HSTS preload list:

  1. Log into Cloudflare and select your domain.
  2. Select Crypto.
  3. On SSL, choose Full (strict).
  4. On Always Use HTTPs, turn it ON.
  5. On HTTP Strict Transport Security (HSTS), click Change HSTS Settings.
  6. Here’s what I have set for these settings:

    HSTS Cloudflare settings

    Status: On
    Max-Age: 12 months
    Include subdomains: On
    Preload: On
    No-sniff: On

  7. I also have “Automatic HTTPS Rewrites” turned ON, so that any requests to HTTP on my domain get redirected to HTTPs automatically.

Once you completed those steps on Cloudflare (assuming that you already have your domain set up there and you’re using it), then you should be able to immediately go on over to the preload website and submit your domain. When I did this, it immediately was accepted and went through.

As I mentioned, I recommend that you set up HSTS and make sure it’s set up properly by submitting it to the pre-load website. This way your domain name will be hard-coded into Google Chrome as one that is fully HTTPs.

Related Posts:
  • 47 TakeAways from Google's John Mueller's AMA on Reddit47 TakeAways from Google's John Mueller's AMA on Reddit
  • Bill Hartzer SEO ConsultantBill Hartzer SEO Consultant
  • 56 Takeaways from Google's Gary Illyes' AMA On Reddit56 Takeaways from Google's Gary Illyes' AMA On Reddit
  • How to Pick the Right Domain Name for your BusinessHow to Pick the Right Domain Name for your Business
  • Google Penalty Recovery Service by SEO Expert Bill HartzerGoogle Penalty Recovery Service by SEO Expert Bill Hartzer
  • Should You Hire an SEO Consultant or an SEO Agency?Should You Hire an SEO Consultant or an SEO Agency?

Filed Under: Google

About Bill Hartzer

Bill Hartzer is CEO of Hartzer Consulting, LLC, an SEO Consulting firm that includes services such as search engine optimization, technical SEO audits, domain name consulting, and online reputation management.

You May Like: Bill Hartzer’s Recent Posts

  • Digital Marketing with Bill Hartzer Podcast December 12, 2019
  • Sales Calls Selling Amazon Alexa Voice Search Listings December 12, 2019
  • Influencer Gets 14 Years in Federal Prison for Hijacking Domain Name December 10, 2019
  • Results of Removing My Google My Business Listing December 2, 2019
  • Google AdSense Sunsetting iOS and Android Apps November 18, 2019
  • Network Solutions Suffers Data Breach in 2019 November 1, 2019
  • State of Search Digital Marketing Conference November 4-5, 2019 October 30, 2019
  • Google My Business Congratulates Local Biz for Getting 1 Click October 20, 2019
  • Google Indexing, Ranking Bing Search Results and Redirects October 18, 2019
  • Yahoo Groups Shutting Down December 14, 2019 October 16, 2019
  • Google My Business Bug Causes 404 Errors on Websites October 13, 2019
  • Bill’s List: Speakers to See and Meet at Pubcon Las Vegas 2019 October 5, 2019
  • Google Bulletin is Shutting Down September 25, 2019
  • How to Protect Your Google Account with Google Advanced Protection September 21, 2019
  • Fake Conference Attendee Contact Lists Being Sold September 13, 2019
  • Google Says Goodbye to Old Google Search Console September 9, 2019
  • US Govt. Social Media Keyword Watch List: Don’t Use These Words on Social Media Posts September 5, 2019
  • How Expired Domain Names Are Used for PBNs, Rebuilds, and Redirects August 29, 2019
  • Do You Have the Legal Right to be Listed in Google? August 23, 2019
  • What Happened When I Removed My Google My Business Listing August 4, 2019

DFWSEM logo

Jim & I are the original Founders of the Dallas/Ft Worth Search Engine Marketing Association.

Bill Hartzer is a Brand Ambassador for:



Industry Friends

WTFSEO
SEO By the Sea
WordPress Website Management
Jeff Lenney

Connect With Bill Hartzer

Bill Hartzer on Twitter
Bill Hartzer on Instagram
Hartzer Consulting on Facebook
Bill Hartzer on Facebook
Bill Hartzer on YouTube


Note: All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only, and are mentioned only to help my readers. All other trademarks cited herein are the property of their respective owners. Use of these names, logos, and brands does not imply endorsement.


Hartzer Consulting Technical SEO Consultants

Website, Content, and Marketing by Hartzer Consulting, LLC.
Copyright © 2019 by Bill Hartzer and Hartzer Consulting, LLC.

Disclaimer - Privacy Policy - Terms of Use