You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “hsts”

Every note filed under hsts, newest first.

A filtered view of the notes.

2026

  1. HSTS: It's Time to Go HTTPS-Only

    The header that makes HTTPS non-negotiable — no SSL stripping, no click-through, no fast rollback. Turn it on. Then think carefully before you preload, because that part you cannot take back.

    security http tls hsts web browsers privacy dissecting-systems

  2. Where Did This Request Come From?

    The Sec-Fetch-Site, -Mode, -Dest and -User headers answer a question servers could never ask — and turn a class of cross-site attacks into a four-line check.

    security csp http web browsers csrf cookies hsts dissecting-systems