> If you use Hiawatha you get A+ with out of the box settings.
Which means they set long HSTS by default, which will bite you quite badly if you're not ready yet for an irreversible HTTPS rollout. But yeah, A+ looks awesome on comparison tables, doesn't it?
No, it does not set a HSTS header by default. And the out of the box rating is A, not A+. However, with a simple setting you enable the HSTS header, which gives you the A+ rating.
Which means they set long HSTS by default, which will bite you quite badly if you're not ready yet for an irreversible HTTPS rollout. But yeah, A+ looks awesome on comparison tables, doesn't it?