Editing How to use EPrints with HTTPS (section)

== HTTPS Only == 
EPrints default HTTPS configuration is usually sufficient for most institutions needs, as there is no absolute need to encrypt the requesting and sending of Open Access research.  However, if you wish to only ever use HTTPS, then follow the instructions for [[HTTPS-only and HSTS]].  HSTS (HTTP Strict Transport Security) ensures that even if the link you click on is for HTTP, your web browser will convert this to HTTPS before making the request.  Meaning you will never send any un-encrypted traffic to EPrints.  It also helps reduce the load on your repository's server, as it save it having to do the HTTP to HTTPS redirection.  

It is generally a good idea to enable HSTS even on repositories with default HTTPS configuration, in case there are any errant bespoke links that could send private information using HTTP.  This can be done by adding the following line to <code>EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf</code> after the <code>ServerName</code> line and then restarting Apache again:

 Header set Strict-Transport-Security "max-age=15780000"