Send HSTS on HTTPS pages.

2026-09-26 15:27:51 +02:00
parent b6a1eff3e6
commit 30b275b902
2 changed files with 10 additions and 0 deletions
@@ -10,6 +10,8 @@ header('X-Frame-Options: DENY');
 header("Content-Security-Policy: frame-ancestors 'none'");

 if (isset($_SERVER['HTTPS'])) {
+  // Browsers use HTTPS for this host for a year, without a plain request first
+  header('Strict-Transport-Security: max-age=31536000');
  session_cache_limiter('private');
  session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
  session_start();