Yesterday, the certificate for my blog expired. While updating the certificate, I also checked the site's security on the MySSL website. Due to the lack of HSTS, the site only received an A rating instead of an A+. Therefore, I added HSTS to the blog and also enabled full-site HTTPS.
Enabling HSTS in Nginx#
HSTS, short for HTTP Strict Transport Security, is an internet security policy mechanism published by the Internet Engineering Task Force. Its main purposes are:
- Forcing clients (such as browsers) to establish connections with servers using HTTPS
- Protecting websites and reducing session hijacking risks
Enabling HSTS is simple. Taking a website deployed with LNMP as an example, first switch to the Nginx site configuration directory:
cd /usr/local/nginx/conf/
Then, find the configuration file for the site in the Nginx directory and open the domain.com.conf file. Under Server 443, add the following:
# HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
After performing the check again, you will notice that the rating has changed to A+:
Enabling Full-site HTTPS#
Since some work on full-site HTTPS has already been done before, this time it is just a supplement and improvement. Here is a brief explanation, and you can search online for more detailed information.
- Log in to the Typecho backend -> Settings -> Basic Settings -> Site Address, and change it to the HTTPS domain.
- Edit the
config.inc.phpfile in the Typecho site's root directory and add the following line of configuration:
/** Enable HTTPS */
define('__TYPECHO_SECURE__',true);
- Edit the
comments.phpfile in the theme folder and replace$this->commentUrl()with:
echo str_replace("http","https",$this->commentUrl());
- Update the attachment URLs referenced by the site to HTTPS. Execute the following SQL database operation, where
domain.comis the site's domain:
UPDATE `typecho_contents` SET `text` = REPLACE(`text`,'http://domain.com','https://domain.com');
- Redirect port 80 (HTTP) to port 443 (HTTPS) using the web server (Nginx) to enforce full-site HTTPS.
- Finally, open the Chrome browser and press F12 to see the prompt
This page is secure (valid HTTPS).
