Hosting and network

Required

• Serve everything over HTTPS

  Required

  Serve every page over HTTPS, the encrypted web, using TLS 1.2 or 1.3 and a valid certificate chain. Redirect plain HTTP to HTTPS.

• Renew certificates automatically

  Required

  Renew every certificate automatically, and get an alert when one has under 14 days left.

• Keep the domain name yours

  Required

  Renew the domain automatically, lock it against transfers and protect the registrar account with two-factor login. A lapsed or stolen domain takes down the site and its email.

Recommended

• Turn off old encryption

  Recommended

  Allow only TLS 1.2 and 1.3, with ECDHE key exchange and AEAD ciphers. Turn off TLS compression and 0-RTT for requests that change data.

• Serve over HTTP/2 or HTTP/3

  Recommended

  Serve the site over HTTP/2 at least, and over HTTP/3 where the server supports it.

• Choose who may issue your certificates

  Recommended

  Publish DNS CAA records. They list which certificate authorities may sign certificates for your name. All others must refuse.

• Host where routes are signed

  Recommended

  Host the site and its DNS with providers that sign their internet routes with RPKI. They should also drop invalid routes.

• Be reachable over IPv6

  Recommended

  Make the site and its DNS reachable over IPv6 with AAAA records, as well as over IPv4.

Optional

• Send more in the first round trip

  Optional

  Let the server's first send carry the whole page. Raise the TCP initial congestion window. That is how much the server sends before waiting for a reply. Then the whole compressed HTML goes out without waiting.

• Sign your DNS

  Optional

  Sign the DNS zone with DNSSEC, so answers can't be forged. Then add the DS record where you bought the domain.

• Use TLSA records only where checked

  Optional

  Publish TLSA records only for services whose clients check them, such as mail servers. Browsers do not check them.