2017-01-29, 02:52 AM
Hi all,
I've been thinking about offering this for a while now and figured I might as well see if anyone's interested.
With Chrome and Firefox now marking pages that contain password fields as insecure, there's a greater necessity for forum/site admins to secure their forums with SSL/TLS to both keep their users' information secure and to keep user confidence up, since most were likely unaware of the security implications of typing in credentials without any transport layer security, but are now informed by their browsers of the risks of unencrypted connections.
Since I've built up a pretty significant amount of knowledge about configuring web servers, setting security headers, etc., I'm offering to set up forums (or really any type of site) with HTTPS-by-default, deploying security headers, and (optionally) periodically updating configuration on servers as best practices change.
Features/Services that I can provide:
I haven't nailed down how I'm going to price things yet, so if you're interested, shoot me a PM and we can agree to something reasonable as long as you're not expecting it to be free (I'm thinking like mid $xx to low $1xx for most cases).
I'm prepared to offer these services for cPanel users, Debian/Ubuntu/CentOS servers (ideally running Apache or nginx), and possibly other platforms upon request.
Also, I feel like I need to address this: you can totally do most of this yourself by following the docs page. I think the value I provide, however, is being a single point of contact who's knowledgeable about the subject and confident in how to make the necessary changes so that you don't have to worry about them, in addition to being able to get fairly rapid support if something goes wrong. I'll make things work, and if I don't, I won't charge you for anything that doesn't work.
I've been thinking about offering this for a while now and figured I might as well see if anyone's interested.
With Chrome and Firefox now marking pages that contain password fields as insecure, there's a greater necessity for forum/site admins to secure their forums with SSL/TLS to both keep their users' information secure and to keep user confidence up, since most were likely unaware of the security implications of typing in credentials without any transport layer security, but are now informed by their browsers of the risks of unencrypted connections.
Since I've built up a pretty significant amount of knowledge about configuring web servers, setting security headers, etc., I'm offering to set up forums (or really any type of site) with HTTPS-by-default, deploying security headers, and (optionally) periodically updating configuration on servers as best practices change.
Features/Services that I can provide:
- HTTPS-by-default with basic security headers (HSTS, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options). Also includes reports from various SSL/TLS testing tools to prove that I've provided value.
- Content Security Policy header
- Mixed content cleanup, where possible (i.e. clean up common image host links, forum theme asset links)
- Setup of a mixed-content proxy to go with DVZ Secure Content to avoid virtually all mixed content warnings
- Direct (free) support via email/PM for as long as you use my services/config and aren't an unreasonable pain to deal with.
I haven't nailed down how I'm going to price things yet, so if you're interested, shoot me a PM and we can agree to something reasonable as long as you're not expecting it to be free (I'm thinking like mid $xx to low $1xx for most cases).
I'm prepared to offer these services for cPanel users, Debian/Ubuntu/CentOS servers (ideally running Apache or nginx), and possibly other platforms upon request.
Also, I feel like I need to address this: you can totally do most of this yourself by following the docs page. I think the value I provide, however, is being a single point of contact who's knowledgeable about the subject and confident in how to make the necessary changes so that you don't have to worry about them, in addition to being able to get fairly rapid support if something goes wrong. I'll make things work, and if I don't, I won't charge you for anything that doesn't work.