Differences

This shows you the differences between two versions of the page.

--- linux_wiki:apache_http_server [2018/03/23 16:02]
billdozor [ssl.conf]
+++ linux_wiki:apache_http_server [2018/03/23 16:04]
billdozor [Redirect HTTP to HTTPS]
@@ Line 175: / Line 175: @@
 </code>
   * Look for "Supported Server Cipher(s)" and "Preferred Server Cipher(s)"
+----
+===== Other Security Settings =====
+Other important security settings.
+==== Redirect HTTP to HTTPS ====
+Redirect all HTTP to HTTPS<code bash><VirtualHost *:80>
+  ServerName example.com
+  <IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteCond %{HTTPS} off
+    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
+  </IfModule>
+</VirtualHost></code>
+----
+==== HSTS ====
+Enabling HTTPS Strict Transport Security (HSTS).
+Add the strict transport security header to the listening HTTPS host section
+<code bash># Optionally load the headers module:
+LoadModule headers_module modules/mod_headers.so
+<VirtualHost *:443>
+    Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
+</VirtualHost></code>
+  * max-age=63072000 -> Tell web browsers to connect to the site using HTTPS only for two years. Countdown is reset each time the site is visited.
 ----