Support for HTTP Strict Transport Security / HSTS
I'm wondering if Plesk also will implent HTTP Strict Transport (or HSTS) Security in the GUI. It's an extra layer of security for sites who need to be extra secure.
It's being done with a special header (mod_headers for Apache) and a TLS connection. The client (browser) can then verify if the server is the real server and not a man-in-the-middle server/attack.
It's as simple as adding the following code to the vhost config (HTTPS only!):
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
The functionality is now available in the SSL It! Plesk Extension: https://ext.plesk.com/packages/3c4117f6-c05c-4d3b-9173-60f10096a9c4-sslit
How to find it:
1. install SSL It! Extension (it’s available for Plesk 17.8+)
2. go to > SSL/TLS Certificates
3. if there is no SSL Certificate installed on the domain – issue one (using, for example, free Let’s Encrypt SSL Certificate)
4. if an SSL Certificate is installed on the domain, there is a switcher HSTS, turn it on
We would appreciate hearing your feedback on the implementation of this functionality. Thanks in advance!
Denver Prophit Jr. commented
Your KB needs to update the NGINX HSTS with the always parameter.
Alexander Yamshanov commented
I was tempted to copy/paste the solutions given on the forum and here....
Later I noticed I needed to change them as they were giving problems.
One is minor and only involves the testing of the domain by SSLlabs.
It turned out that SSLlabs chokes on websites that need credentials to test HSTS
These sites need the "always" attribute.
The other one is the flag "includeSubDomains".
As most will use this nginx directive server wide and they don't really know for a 100% what their clients are up to, you shouldn't use that flag.
I had a client that was running a plain http-only domain on a subdomain on some other server.
That site stopped working for all clients that previously went to their main site.
IMHO the flag includeSubDomains doesn't add anything extra for the site you're securing.
It limits all the sites of that domain to https.
This may be sensible for 1 specific domain, but most likely not a decision for you to make for ALL your clients.
add_header Strict-Transport-Security 'max-age=15768000' always;
Nelsir Carlos Luterek commented
This feature will be very useful since many internet sites like google chrome browser already uses this technology, my vote is to be implemented in plesk.
Jordan Schelew commented
I'm in favour of this as well. But a quick warning: make sure to remove the 'includeSubDomains' if the domain is being used for the Quick Preview URL.
Peter Downes commented
A very simple feature to implement, yet it's been 3+ years. Having to patch it through HTTP directives.
[Deleted User] commented
Great idea, hopefully it will be added to Plesk (12.5 would be great).
This could be added for each subdomain/domain config page, just add a tickbox like the one that allows recirect from http to https.
Michael Lux commented
I'm already using HSTS via custom headers and would greatly appreciate a standard, less error-prone way for always using HSTS headers and automatic redirect to HTTPS.
@Marco Marsala: HSTS is a great technique and so far the only promising technique to stop SSL-Stripping attacks, for example in public WiFis.
The reason for big sites not using this is that it can break backwards compatibility in some scenarios, which seem more important to them than the security of their customers.
Lloyd Day commented
In my opinion, you would want something like the preferred domain setting so you could set https preferred which would...
- add a 301 redirect to https (in Apache HTTP)
- add the HSTS header (in Apache HTTPS)
- along with corresponding 301 redirect in Nginx
Marco Marsala commented
No big sites, like Facebook, use that header.
Web Master commented
what's keeping Plesk so long to implement this?