Editing Apache Hardening (section)

== HTTP Strict Transport Security (HSTS) ==
HSTS ensures that a visitor's (to your EPrints repository) web browser only uses HTTPS, once they are aware HTTPS is available.  It is now quite common to setup an  Eprinst repository to be [[Simplified_HTTPS_Configuration#HTTPS_Only|only HTTPS with HTTP redirects]].  If this is the case only your visitor's first request will be HTTP and then their web browser will know to use HTTPS from there on.

The following line should be added to near the top of the HTTPS virtualhost, (i.e. in the archive's '''ssl/securevhost.conf'''):
 Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
The '''max-age=31536000''' is the recommended length in seconds (365 days, i.e. approx. 1 year).  '''includeSubDomains''' is not absolutely necessary unless the repository has alternative hostnames that are under the primary hostname (e.g. ''www.example.eprints.org'' is a secondary hostname for ''example.eprints.org'').  '''preload''' is only really useful if your repository is the root of a domain (e.g. ''eprints.org'') is on browsers preload lists (e.g. [https://hg.mozilla.org/mozilla-central/raw-file/tip/security/manager/ssl/nsSTSPreloadList.inc]).  This will make sure that even the first request for your repository is rewritten to HTTPS before being submitted by your visitor's web browser.