RE: [users@httpd] How is this possible? Apache sends HSTS on a non valid cert but user can proceed, on compatible browser

[Eddie B]

Great answer, thank you Scott.

 

Do you recommend only setting the HSTS header for https requests?