Hacker News Reader

All of .dev is covered by HSTS pre-loading. So even if you explicitly type http://web.dev/ you are going to actually navigate to https://web.dev/ because that's how HSTS is defined. If you want a site that isn't encrypted in browsers then an entire TLD which is specifically secured is the wrong place to build that site.

View on HN

I think I explained myself badly. Im entering sites INTO https://web.dev that we make at work. Web.dev is basically Google Lighthouse and tests your website for basic performance, seo, best practices and A11Y.

So for example I enter mycustomer.com and it tells me "avoid http redirects" because I didn't enter the https:// before.

Hsts is included in one of our packages which also includes CSP settings and other security stuff, but barely anyone buys that.

Reply on news.ycombinator.com