The redirect chain
Every extra hop costs a round trip before anything is drawn, and a mobile connection pays for it twice. The right setup is one redirect: from http to https and from www to the bare domain, or the other way round, done in a single step instead of a chain where each step fixes one thing.
Watch where the first redirect lands. A request to http://www.example.com should reach the final address at once, not travel through https://www.example.com on the way. A Strict-Transport-Security header is only honoured on an https response, so the first plain http request still has to be answered with a redirect.
Security headers
- Strict-Transport-Security
- Tells the browser to use https for this host from now on, even when a link says otherwise.
- Content-Security-Policy
- Sets where the page may load scripts, styles and frames from. The most effective single header, and the one that needs the most testing.
- X-Content-Type-Options
- With the value nosniff it stops the browser from guessing a file type other than the declared one.
- Referrer-Policy
- Controls how much of the current address is passed on to other sites in the Referer header.