Tag Archives: HSTS

HTTP Strict Transport Security

Secure Redirects in Plesk

More and more sites are only available via https, now with the Let’s Encrypt extension available in Plesk 12.5 it’s even easier to make your site secure. As such I thought it would be a good time to write this guide.

This guide assumes…

    • You have already setup your SSL Certificate in Plesk for your domain,
    • You are using Apache (FastCGI or FPM) and Nginx is serving static files,
    • You want your site to be https only, redirecting all http requests to https
    • You have set preferred domain in Plesk to www.domain.tld

Apache

I’ll start with Apache, browse to your domain in Plesk and click on Additional Apache & Nginx settings. under Additional directives for HTTP use this redirect..

And Additional directives for HTTPS…

If you use Plesk’s built in SEO Safe redirect (preferred domain) from domain.tld to www.domain.tld, you will need to turn this off and add the following in the Additional HTTPS directives…

Nginx

Now onto the Nginx directives…

Notice I’m using $scheme rather than the more common $host, as using the $host rewrite affected ssllabs scores in that domain.tld and www.domain.tld would score differently after adding HPKP and HSTS headers in Apache.

I hope that helps someone.

Updated to reflect changes at: https://hstspreload.org/

Add HSTS to Plesk Panel

Here’s how you can add HTTP Strict Transport Security (HSTS) to your Plesk Panel.
This only applies to Plesk 11.5.30 and Plesk 12.0.18, older versions used lighttpd.

Locate the file and edit with your favourite editor…

And add the normal Nginx HSTS directive under the certificate entries like so…

Save the file and restart the Plesk server…

Now you have Strict Transport Security on your panel.
I will show you how to add OCSP to your Plesk Panel later in the week.

To add HSTS to domains hosted on Plesk, see Secure Redirect in Plesk