Another thing: You should probably go TLS-only. Set up a 301 redirect from HTTP to HTTPS, and set the Strict-Transport-Security header on all HTTPS responses.<p>It&#x27;s very easy to do, and ensures all your users get maximal security. The future is encrypted.<p>Today I did this for my blog: <a href="https:&#x2F;&#x2F;github.com&#x2F;TazeTSchnitzel&#x2F;blog&#x2F;commit&#x2F;792986d18d8583712fa3fe59d0ec047b21701d46" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;TazeTSchnitzel&#x2F;blog&#x2F;commit&#x2F;792986d18d8583...</a>