Site security, part 1: HTTPS, TLS 1.2, and HSTS
In the previous post I wrote about the day the site left the notebook and started opening at rodrigoesporto.com, on Cloudflare Pages. This part is different. Now the subject is the lock: the three switches I turned on in the panel so a visitor does not land on an open version of the page.
What I wanted to solve
On 3 October 2026 the personal site went live. I work during the day, and at night and on Sundays I build with AI agents. Having the address live is not enough. I wanted every visit to go to the version with the lock.
Without the lock, the page travels in the open. Someone on the path can read it or change what the person asked for. With the lock, the trip is closed.
I use Cloudflare. I pay them for the domain. I am not reviewing the company from the outside. I am telling you about the three switches I turned on in the panel, clicking myself, with Darth checking from outside. Darth is the main bot: it takes any request and sends it to the right agent.
Quick summary
- In the Cloudflare panel I turned on always HTTPS: every visit goes to the version with the lock.
- TLS 1.2 became the minimum: only modern encrypted connections get in.
- I turned on HSTS: the browser starts to remember that the site only opens with the lock.
- On the SSL Labs test the site scored A+. That went into the security review by the Segurança agent, on 3 October 2026.
- These three switches are free on Cloudflare and take minutes.
First: what HTTPS is
HTTPS is the way to open a site with the lock. The S, in this case, stands for “secure.” HTTP, without the S, is the open version.
Anyone on the mail belt can read a postcard. An envelope hides the note. What actually happens: the browser asks for the page over an encrypted connection. Encrypt, here, means scrambling what travels on the network with a code that only the two sides of the conversation have. Someone trying to read or change the page on the way does not see the clear text.
The envelope comparison stops at one point. You can tear a paper envelope and read it. Here, without the code to that conversation, what travels on the network does not become the page. Another limit, and this one matters: the lock does not prove I wrote something true. It protects the path. The text is still the text.
What TLS 1.2 is
TLS is the protocol behind the lock. Protocol, here, means the agreed rules of the encrypted conversation. 1.2 is the oldest version I still accept.
On a front door you can still take an old key that is easy to copy, or you can refuse it and keep only the current key. On a site, the browser and the server need to speak the same TLS version for the lock to work. “Minimum 1.2” means I refuse anything older. Only modern encrypted connections get in.
A house door has one lock. A site serves many people at once, each with whatever browser they have. The minimum is the oldest version I still allow. Above that, a current browser uses whatever is newer, if both sides have it.
I will not invent the name of each button in the panel. In this part, the fact is this: TLS 1.2 as the minimum.
What HSTS is
HSTS is an instruction the site sends to the browser. The full name is HTTP Strict Transport Security. In everyday language: the browser starts to remember that this site only opens with the lock.
Picture a note on the door: this shop does not serve through the window, only through the locked door. Next time, the person does not even try the window. What HSTS actually does: after a visit with the lock, the browser stores the rule and refuses the open version. If someone on the path tries to push HTTP without the S, the browser does not take it.
The note on the door depends on the person having been there already. HSTS lives in the browser of someone who already visited. There is no guard on the street. The memory sits on the device itself.
HTTPS alone still leaves one annoying gap: a person can type the address without the lock, or an old link can point to the open version. HSTS closes that habit. The site tells the browser, and the browser remembers.
The SSL Labs test
SSL Labs is a public test that looks at how a site’s lock is set up and gives a grade. The test address: https://www.ssllabs.com/ssltest/.
You enter the site address, the service tries to talk to it the way a browser would, and it returns a grade. In my case, the grade was A+.
That grade talks about the lock and the encrypted conversation. It is not the full picture of the site’s security.
The source of this grade is the security review by the Segurança agent, on 3 October 2026. Segurança is the agent that checks every day, from outside, whether the site is still safe, without touching anything.
What I used
I used the Cloudflare panel. I used the domain rodrigoesporto.com, already live. I used Darth to check from outside while I clicked. I used the Segurança agent for the 3 October 2026 review. I used the SSL Labs test.
Login, password, and account screens stay out of this text.
How it went
If you want to copy the design, the path is this:
- Have the site live at your own address. In my case, that had already happened on Cloudflare Pages.
- In the panel, turn on always HTTPS. When it works, anyone who tries the version without the lock is sent to the version with the lock.
- Set TLS 1.2 as the minimum. When it works, only modern encrypted connections get in.
- Turn on HSTS. When it works, the browser starts to remember that the site only opens with the lock.
- Check from outside. I clicked. Darth checked from outside.
- Run the SSL Labs test on the public address. In my case, the grade was A+.
I will not invent the panel screen. What matters is the design: I click, someone checks from outside, the visitor only arrives with the lock.
What went wrong, or what I learned
This time I do not have an error message from these three switches to tell. What I have is the habit of not skipping the lock because the names sound like an engineer’s manual.
HTTPS, TLS, and HSTS sound like jargon. On Cloudflare, the three switches are free and take minutes. That is the lesson for someone starting out.
None of these tools replace judgment. They shorten the path between “I know what I want” and “it is live.” The lock protects the path. If the text is wrong, it still arrives wrong. It just arrives closed.
Costs and limits
Money cost of these three switches, in this part: free on Cloudflare. Time: minutes in the panel.
What they do not do: they do not make the content true. They do not replace the check from outside. They do not cover the rest of the site’s security.
I use Cloudflare and I pay them for the domain. The A+ grade came from the SSL Labs test, in the Segurança review, not from a company ad.
What I would do differently
I would not leave it as “I will look at security later.” The names look scary. The click is not. I do not have, in this part, a case where the site sat live without the lock. It is the habit I want.
Who it is for, and who it is not for
It is for someone who put a personal site live and has not turned on the lock yet. It is for you if the host offers these switches in the panel, the way Cloudflare does in my case.
It is not a security course. It is not for you if you need a report for a company. It is not for someone who wants the agent to click instead of them: I clicked; Darth checked from outside; Segurança keeps checking from outside, without touching anything.
Closing
The visitor deserves the locked version. Always HTTPS, TLS 1.2 as the minimum, and HSTS are three free switches, minutes of work, and on the SSL Labs test the site scored A+.
The next step, if your site is already live, is to turn those three on and run the test. If you want to follow the rest of this journey, I am on X: @RodrigoesPorto.
In the next part I cover site security, part 2: DNSSEC, fake email, CAA, bots, and www.
Sources and links
- SSL Labs test: https://www.ssllabs.com/ssltest/
- Security review by the Segurança agent, 3 October 2026
- Cloudflare panel, on the HTTPS, TLS 1.2, and HSTS switches