Hacker News Reader

I'm interested If that behavior will be the same when using web.dev

Usually when I enter a site to test it there, it always tells me to avoid redirects. I think HSTS would would have also solved this, but our (managed) hosting provider does not offer this as a default, and doing it manually for the amount of sites is not really practical. At least not the sites that are already done.

View on HN

All of .dev is covered by HSTS pre-loading. So even if you explicitly type http://web.dev/ you are going to actually navigate to https://web.dev/ because that's how HSTS is defined. If you want a site that isn't encrypted in browsers then an entire TLD which is specifically secured is the wrong place to build that site.

I think I explained myself badly. Im entering sites INTO https://web.dev that we make at work. Web.dev is basically Google Lighthouse and tests your website for basic performance, seo, best practices and A11Y.

So for example I enter mycustomer.com and it tells me "avoid http redirects" because I didn't enter the https:// before.

Hsts is included in one of our packages which also includes CSP settings and other security stuff, but barely anyone buys that.

Reply on news.ycombinator.com