Enable HTTP strict transport security (HSTS)

This ensures all traffic to the Halo site can only use a secure HTTPS connection.

HTTPS must already be configured for the web application.

Currently, these steps are required after any upgrade. If HTTPS/SSL is not configured, and HSTS is enabled, the application will not work.

Open web.config in the root of your Halo web application website files.

Search for <!--HSTS.

You should see a line that looks like this;

<!--HSTS<add name="Strict-Transport-Security" value="max-age=31536000; IncludeSubDomains" />-->

Remove <!--HSTS from the start and --> from the end of the line.

Save changes.

Restart the website in IIS.