Enabled HSTS with includeSubDomains and preload.
The cost is real and one-way: every current and future subdomain must serve HTTPS or become unreachable. Removal from the preload list is in browser-release hands, not yours.
Accepted because the site is HTTPS-only by intent and Caddy provisions certs for every subdomain automatically via Let's Encrypt.
💡Denk mee en reageer op de consultatie van het aangepaste “Besluit beveiligde verbinding met overheidswebsites en -webapplicaties”: https://www.internetconsultatie.nl/verzamelbesluitdigitaleoverheid
📜In het herziene besluit op basis van de Wet digitale overheid wordt verwezen naar nieuwe versies van de TLS- en Webapplicatie-richtlijnen van @ncsc_nl. Reageer voor 6 jan, 2026.
Meer info over het huidige besluit: https://www.digitaleoverheid.nl/overzicht-van-alle-onderwerpen/wetgeving/wet-digitale-overheid/veelgestelde-vragen-verplichting-https-en-hsts-voor-overheidswebsites/
#beveiliging #websites #openstandaarden #HTTPS #HSTS
@gelatin @wyatt Maybe I'm missing something. If an attacker on a coffee shop WLAN sniffs your session cookie for a forum, they can proceed to ruin your life by posting illegal material under your name. There used to be a browser extension called "Firesheep" that would snoop others' cookies for Facebook until Facebook went all HTTPS all the time.
Yes, turns out it was the #hotspot device's #DNS blocking certain sites. Not sure how this appeared as a #HSTS error, but once I cleared my browser settings for that site, I refreshed and got a message from the hotspot device saying the site was blocked.
Setting a different DNS server on my computer bypassed the problem 😉
Certain websites work fine when I access them via my main fibre internet connection, or my phone's mobile data connection. But when accessed via a portable wifi #hotspot device, they show a "Potential security issue" error message citing #HSTS...
Surely if the site works on some networks but not others, it can't be a certificate issue, right?
What would cause this? Some sort of security on the hotspot device?
Researching HSTS, HTTP Strict Transport Security
I think this is why I am disable from accessing many pages that appear to have the HSTS, because indeed I am persistently under their thumb of hackers.
I would like to know if it is possible to achieve a clean OS in the midst of hacked devices and networks that target me for man in the middle attacks
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
🔐 Did you know that TLDs reserved for a single organization — like .sncf or .bnpparibas — can implement a global security policy across all their subdomains using HSTS (HTTP Strict Transport Security)?
👉 Find out more on our blog with @bortzmeyer https://www.afnic.fr/observatoire-ressources/papier-expert/profiter-de-son-domaine-de-premier-niveau-pour-securiser-un-peu-plus-le-web-avec-hsts/
Javed A. Butt
holy moly
Fábio Costa 🐇🕐🎩☕
Forum Standaardisatie
Damian Yerrick
Norm
cybertrapped
Afnic