> That's why there is the HSTS preload list
which has the following requirements: 1. Serve a valid certificate. 2. Redirect from HTTP to HTTPS on the same host, if you are listening on port 80.
oops.
which has the following requirements: 1. Serve a valid certificate. 2. Redirect from HTTP to HTTPS on the same host, if you are listening on port 80.
oops.
> if you are listening on port 80
You don’t have to accept trafic on the http port for HSTS preloading. But iff you do you must redirect it.
This rule makes sense; at least you should never serve content over http.