My .htaccess contains:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Does $WgForceHTTPS make the above .htaccess unnecessary?
Topic on Manual talk:$wgForceHTTPS/Flow
Manual says "the webserver should also be configured to send HTTP Strict Transport Security (HSTS) response headers."
i assume that only applies on a private, not shared, server.