HSTS for Firebase Hosting: Safe Setup and Rollout
HTTP Strict Transport Security sounds simple: send one response header and browsers stop using HTTP for your site. That’s true, but HSTS is one of those headers that can quietly break things if you turn it on too aggressively. I’ve seen teams copy a preload-ready header from a blog post, deploy it, and then discover some forgotten subdomain is still serving plain HTTP. Now users can’t reach it at all. ...