Re: [users@httpd] How is this possible? Apache sends HSTS on a non valid cert but user can proceed, on compatible browser

[Scott (firstclasswatches.co.uk)]

Yes, HSTS requests over HTTP are ignored anyway for similar reasons.

Kind Regards,

Scott

First Class Watches
9 Warwick Road
Kenilworth
CV8 1HD
Warwickshire
United Kingdom

On 6 October 2014 23:19, Eddie B <ed...@mattermedia.com> wrote:

> Great answer, thank you Scott.
>
>
>
> Do you recommend only setting the HSTS header for https requests?
>
>
>