Articles
HSTS Explained: max-age Strategy, includeSubDomains Pitfalls, and the Preload List
A practical HSTS guide: how Strict-Transport-Security works, ramping max-age safely, includeSubDomains pitfalls, preloading, and copy-paste configs.
Fixing Mixed Content Warnings — Finishing the HTTPS Migration You Started
Active vs passive mixed content, how browsers treat each, finding hardcoded http:// URLs, CSP upgrade-insecure-requests, and staying clean after migration.
The .dev TLD Is Here, and It's HTTPS-Only by Design
Google's .dev domains open to the public this month, and the whole TLD is HSTS-preloaded. What preloading means, and how to launch HTTPS-only from day one.
TLS 1.3 Is Final: What RFC 8446 Changes and What to Do About It
TLS 1.3 is final as RFC 8446, after four years and 28 drafts. What changed, what was removed, and how to check what your servers negotiate.
Chrome 68 Is Here: Every HTTP Page Now Says “Not Secure”
Chrome 68 now labels every HTTP page Not Secure. A migration checklist covering free certificates, redirects, mixed content, HSTS and what comes after.
Chrome 62 Marks Your Forms “Not Secure”: Time to Finish the HTTPS Migration
Chrome 62 flags any HTTP page with a text input as Not Secure, search boxes included. What changed, who's affected, and a practical migration checklist.
HTTP/2 Is Ready: What It Actually Means for Your Site
HTTP/2 is now practical to deploy. What multiplexing and header compression change, how to enable it on nginx, and which old habits to unwind.
Let's Encrypt Is Out of Beta: Free HTTPS for Everyone, and a New Way to Fail
Let's Encrypt has left beta after issuing over a million free certificates. How ACME works, a basic nginx setup, and the silent renewal failure to watch for.
Why Your Website Needs HTTPS, Even If It's a Brochure Site
Free certificates, a small Google ranking boost, HTTP/2 and ad-injecting hotspots: why every site should move to HTTPS in 2016, not just stores.
More topics
Get notified when CompleteStatus opens
New accounts are closed while we're in private beta. Leave your email and we'll send one message the moment sign-ups open — nothing else.