Securing Connections with the SSL It! Extension – Enhancing security of your websites and encrypted server connections

Merely securing a website
with a valid SSL/TLS certificate from a trusted CA
is not enough to get all-round protection.
SSL is a complex technology,
which has a number of features (key encryption algorithm, secure ciphers,
HSTS, and much more) that can do the following:

• Enhance the security of your website’s visitors.
• Improve your website performance.
• Harden the security of all server’s encrypted connections

Enabling these features can improve your websites’ search engine rankings:

• “Redirect from http to https” sets up a permanent,
  SEO-safe 301 redirect from the insecure HTTP
  to the secure HTTPS version of the website and/or webmail.
• HSTS prohibits web browsers from accessing the website
  via insecure HTTP connections.
• OSCP makes the web server request the status of the website’s certificate
  (can be good, revoked, or unknown)
  from the CA instead of the visitor’s browser.
• TLS versions and ciphers by Mozilla
  harden connections secured with SSL/TLS certificates
  (website, mail, Plesk, and so on).

To enhance the security of your websites and encrypted server connections:

1. Secure your website with a valid SSL/TLS certificate from a trusted CA.

2. Go to Websites & Domains > your domain > SSL/TLS Certificates.

3. If you have upgraded to Plesk Obsidian from earlier Plesk versions,
   turn on “Redirect from http to https”.
   The redirect will be also applied for webmail by default.
   On clean Plesk Obsidian installations,
   the redirect for the domain and webmail is already turned on by default.

   Note: If your webmail is not secured with a valid SSL/TLS certificate
   or you do not have any webmail,
   clear the “Include webmail” checkbox.

4. Enable HSTS:

   1. Turn on HSTS.

   2. Make sure that an SSL/TLS certificate
      that secures your website will be valid
      during the “Max-age” period.
      Do the same for subdomains and the webmail subdomain.
      Otherwise, if the SSL/TLS certificate expires earlier
      than the “Max-age” period and HSTS is turned on,
      visitors will not be able to access your website.

   3. …