As you are well aware by now, I moved this site to HTTPs (a secure SSL site) back a few years ago when Google announced that HTTPs is, in fact, a search engine ranking factor. Google has announced that they’re making HSTS (HTTP Strict Transport Security) the default on all of the Google-owned TLDs, starting with .dev and .foo. This is really good news, as any domain name on those TLDs (Top Level Domains) will be secure and using HTTPs URLs.
Starting in October, Google Chrome will begin to show warnings to users that a website is not secure when they fill out a form on your website. Firefox already does this, but there’s an additional need to move your website to HTTPs immediately. If you haven’t moved your website to HTTPs yet, then contact me and I can help you move to HTTPs.
Google’s announcement on their blog announces the HSTS preload list:
Earlier this year we announced that Chrome will start displaying warnings on insecure sites, and we recently introduced fully managed SSL certificates in App Engine. And today we’re proud to announce that we are beginning to use another tool in our toolbox, the HTTPS Strict Transport Security HSTS preload list, in a new and more impactful way.
Well, in Google’s announcement, they also have set up a pre-load list for the Chrome web browser. That means that if your domain name complies with the necessary guidelines and requirements, then you can submit your domain name to the Chrome pre-load list. The domain names on this list are hard-coded into Google Chrome. This is something that you’ll want to do–which could be even more of a “trust signal” for Google. If I were Google, I would trust domain names on this list more than other domain names that are NOT on the list. But, that’s just me. I don’t know what Google is going to do.
So how do you get your domain name on the HSTS preload list so your domain name is hard-coded into Google Chrome? Here’s what you need to do:
- First, make sure your website is HTTPs and has a valid SSL certificate installed. If you’re wanting to do this on the cheap, then use a site like Cloudflare.com to cache your site and get your domain name a free SSL certificate.
- Go to https://hstspreload.org/ and check your domain name. If it’s valid, and set up properly, and meets the requirements, you’ll be able to agree to the terms, check the boxes, and submit your domain name.
- If you get a warning, then you’ll need to look at the warnings that you’re getting. The site should give you some indication of what you’ll need to do.
One of the warnings I received for my domain name was that the max-age wasn’t set up properly. There are a ways to deal with this: have your developer or web host fix the max-age setting on your site’s headers. If you’re comfortable enough, with editing your .htacess file (on a unix server) then you can add the max-age lines of code to the .htaccess file and you should be set to go.
Another option, which made it easy for me, was to set up HSTS on Cloudflare. I have a SSL certificate on my domain and on my host’s domain, and Cloudflare. I was able to go in and set up the HSTS properly so that it has the max-age setting as well as the other redirects required.
On Cloudflare, do this to set up the HSTS properly so that you can submit your domain to the HSTS preload list:
- Log into Cloudflare and select your domain.
- Select Crypto.
- On SSL, choose Full (strict).
- On Always Use HTTPs, turn it ON.
- On HTTP Strict Transport Security (HSTS), click Change HSTS Settings.
- Here’s what I have set for these settings:
Status: On
Max-Age: 12 months
Include subdomains: On
Preload: On
No-sniff: On - I also have “Automatic HTTPS Rewrites” turned ON, so that any requests to HTTP on my domain get redirected to HTTPs automatically.
Once you completed those steps on Cloudflare (assuming that you already have your domain set up there and you’re using it), then you should be able to immediately go on over to the preload website and submit your domain. When I did this, it immediately was accepted and went through.
As I mentioned, I recommend that you set up HSTS and make sure it’s set up properly by submitting it to the pre-load website. This way your domain name will be hard-coded into Google Chrome as one that is fully HTTPs.