Support for HTTP Strict Transport Security / HSTS
I'm wondering if Plesk also will implent HTTP Strict Transport (or HSTS) Security in the GUI. It's an extra layer of security for sites who need to be extra secure.
It's being done with a special header (mod_headers for Apache) and a TLS connection. The client (browser) can then verify if the server is the real server and not a man-in-the-middle server/attack.
It's as simple as adding the following code to the vhost config (HTTPS only!):
Apache:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Nginx:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
linqlol
shared this idea
Hi!
The functionality is now available in the SSL It! Plesk Extension: https://ext.plesk.com/packages/3c4117f6-c05c-4d3b-9173-60f10096a9c4-sslit
How to find it:
1. install SSL It! Extension (it’s available for Plesk 17.8+)
2. go to > SSL/TLS Certificates
3. if there is no SSL Certificate installed on the domain – issue one (using, for example, free Let’s Encrypt SSL Certificate)
4. if an SSL Certificate is installed on the domain, there is a switcher HSTS, turn it on
5. Voila!
We would appreciate hearing your feedback on the implementation of this functionality. Thanks in advance!
-
Dave commented
We need preload
-
Iñigo
commented
Add preload support please
-
William Gérald Blondel commented
The work was half done! No support for preload!
-
Ben
commented
Preload!
-
Tim Wakeling commented
Preload please!
-
André Kasper commented
preload!
-
Anonymous
commented
preload
-
Nikolai Graf-Rüssel
commented
preload
-
David
commented
Please, add preload feature and 1 year option
-
Anonymous
commented
it needs to have the preload option !
-
Remigio
commented
Please add "preload" header feature.
-
Anonymous
commented
Thank you very much for the extension! HSTS preloading would a great feature too. In case you added it, please provide an option for 1 year HSTS header too. Two years is not necessary for most use cases.
-
Michael Lux commented
Great stuff. Everything important in an easy-to-use UI. Two improvement suggestions:
1. Please add optional HSTS preloading. It's an expert feature, but it makes the whole thing even better!
2. Maybe a link to a sever config checker like Qualys SSL Labs to check if everything is working as configured? Useful, for instance, because the plugin won't notice if you already have another HSTS header in place in Server Config...@Adrian Mörchen:
You didn't get what HSTS is about, I'm afraid? Ever heard of TLS/SSL stripping?
Sure, if the TLS certificate renewal fails (99 % of the time because the server admin is an idiot and blocked something or screwed up configuration), then it's a p.i.t.a. So is every other configuration error that prevents your domain from working.
I take care of dozens of websites, all protected with Let's encrypt and HSTS. Guess how often I experienced the renewal problem? Exactly once, because of a screwed up nginx config file. -
Christian Heutger
commented
I'm not sure, if that's the best place, but there seems to be a "bug" in your current SEO safe redirects setup regarding HSTS and primary using the HSTS preload list.
This list requires, that the headers are sent from https://example.com (maybe redirected by http://example.com and not first redirecting to http://www.example.com and then https://www.example.com) as the preload submission tool rejects such redirects.
So your SEO safe redirects are working somehow the "wrong order", if HSTS submission is planned.
-
Adrian Mörchen
commented
-1
HSTS also has some disadvantage.
I.e. ever tried to open a site where for whatever reason the generation of a new certificate failed? p**n in the *ss. (alternative HSTS with very low max-age, but then it isn't useful at all)
Instead there should be a global option for "always redirect to https".
-
Michael Koontz commented
The addition of HSTS support in Plesk would be a great addition. Please consider adding this soon.
-
Stevans
commented
+1
-
Anonymous
commented
+1
I plan to switch on hsts this year on all https websites, with or without plesk, but would be quite disappointed if not by plesk (no track of what is done,..) -
[Deleted User]
commented
+1
-
H50K
commented
TRUE, you can set up all this by using "Additional Headers" or .htaccess.
In order not to use .htaccess (slows down a bit) u better use Plesk settings wich should end in .conf!
It would be great if you ad such stuff like the HSTS - Header as a templates.
wth do i have an helpful system like plesk to make my life more easy?!? :-)