We love digital - Call
0330 353 0300Circle Info
and say hello - Mon - Fri, 9am - 5pm

Call 0330 353 0300Circle Info

Hannah Pennington

HTTP Strict Transport Security

20th Dec 2021 SEO Blog 2 minutes to read

HSTS or Strict Transport Security is a standard defined in RFC 6797, by which a web server can declare to a client that it should only be accessed via HTTPS. The web server or crawler will then make all future requests over HTTPS. This will be the case even if following a link to an HTTP URL. From here the SEO Spider shows a Status Code of 307 and a Status of HSTS Policy and a Redirect Type of HSTS Policy.

This redirect is an internal representation in the SEO Spider and the browser. This differs from a 301 or a 302 as it isn’t sent by the web server as its turned around internally. When a webserver declares it should be contacted through HTTPS an expiry on this – this 307 response is ideal as it means temporary re-direct.

Protocol

The HSTS protocol is based on the server sending a single header. This is called a Strict-Transport-Security and is only sent via HTTPS as if sent via HTTP it is overlooked. The header requires 2 associated directives max-age and includeSubDomains.

Max-age is mandatory and lets the server know the number of seconds in which it can only be contacted by HTTPS. IncludeSubDomains is an optional field which if set, signals that HSTS Policy applies to any sub-domains.

Benefits

There are several benefits to using HTTP – > HTTPS Redirect. It reduces the communication over non-secure protocols, reduces load on the web server as well as improving the performance as a round trip is avoided when the HTTP link is encountered.

A site-wide HTTP->HTTPS redirect is still needed due to the Strict-Transport-Security header ignoring this unless it is sent over the HTTPS. If the first visit to your site is not via HTTPS, you still need that initial redirect to HTTPS to deliver the Strict-Transport-Security header. Considering this, you may not expect to see a 307 in the SEO Spider, but makes an HTTP request for the robots.txt file, receives a 301 to the HTTPS version of the site, then receives the Strict-Transport-Security header, so will then report 307 for the first URL crawled. If robots.txt is disabled checking the SEO spider will report a 301.

How to disable HSTS

This can be easily done by unticking: ‘Respect HSTS Policy’ configuration under ‘Configuration > Spider > Advanced’ in the SEO Spider.

The SEO Spider will ignore HSTS completely and report upon the underlying redirects and status codes.

Share this post

Hannah Pennington

Client Services Manager

Artistic Hannah loves spending her time either creating something or giving back and each year she commits to getting hands-on with a different charity. It’s handy then that she wants to be an Octopus because she could use all those extra arms and skills to do all of this at once.

Free Digital Clarity Call

Need some expert help to uncover what’s holding your digital marketing back? Let us show you for free!

What do you think?

aspect-ratio
Sophie Roberts

Kooznews: New Year’s Edition 2021/22

Sophie Roberts
@hospitalitysoph
18th Jan 2022
News
aspect-ratio
Gary Hainsworth

The Differences Between nofollow and noindex

Gary Hainsworth
17th Jan 2022
Marketing Strategy

Digital Ideas Monthly

Sign up now and get our free monthly email. It’s filled with our favourite pieces of the news from the industry, SEO, PPC, Social Media and more. And, don’t forget - it’s free, so why haven’t you signed up already?

Free Digital Clarity Call

Need some expert help to uncover what’s holding your digital marketing back? Let us show you for free!

Unlike 08 numbers, 03 numbers cost the same to call as geographic landline numbers (starting 01 and 02), even from a mobile phone. They are also normally included in your inclusive call minutes. Please note we may record some calls.

Circle Cross