Secure first HTTP request

I'm building Web site, and wondering how I can assure that it is secure if first request is made by HTTP. HSTS do this but partially.

I think not opening HTTP port solve this problem. But is this standard? My site is B to B, so SEO is not problem. Users directly access my addresses, but assume possible with HTTP. Any idea?

Solution

Short answer :

Use HSTS Preload : https://hstspreload.appspot.com/
On https, always sent the HSTS header
On http, always sent a 301 redirect to https

It will protect your visitors even for the first visit thanks to the preload : browsers will know your domain must be contacted only with https even before the first contact (it will be in their source code, see https://github.com/ssllabs/research/wiki/Preload-Lists ).

(and of course, keep your 301 redirect http=>https)

Why closing the port 80 is not a good idea ? Let's see the two options :

Options with HSTS and the port 80 closed :

First visit on http://example.com : Nothing happens
subsequent visits on http://example.com : Nothing happens
First visit on https://example.com : User is secure and HSTS is kept
subsequent visits on http://example.com or https://example.com : User is secure (visits on http gets redirected thanks to HSTS)

In case of an attack :

First visit on http://example.com : Get hacked (the hacker can forge an answer even if your server doesn't respond)
subsequent visits on http://example.com : Get hacked too (the user can be tricked to click on an http link to your website)
First visit on https://example.com : User is secure
subsequent visits on http://example.com or https://example.com : User is secure (visits on http gets redirected thanks to HSTS)

Options with HSTS and the port 80 open :

First visit** on http://example.com : 301 redirect to https (and then gets HSTS)
subsequent visits on http://example.com : User is securely redirect to https (thanks to HSTS)
First visit on https://example.com : User is secure and HSTS is kept
subsequent visits on http://example.com or https://example.com : User is secure (visits on http gets redirected thanks to HSTS)

In case of an attack :

First visit on http://example.com : Get hacked
subsequent visits on http://example.com : User is securely redirect to https (thanks to HSTS)
First visit on https://example.com : User is secure and HSTS is kept
subsequent visits on http://example.com or https://example.com : User is secure (visits on http gets redirected thanks to HSTS)

As you can see, opening the port 80 to answer a 301 redirect to https can improve a little the security (and closing it will not improve it, and will probably confused your visitors)