After using a few tools to check the site's security and performance, I found that there were a few things that could be improved.

HTTP/2

I think that I stopped self-hosting kurtmckee.org back in 2006 or so, and since then the internet has grown up: nobody argues that "Internet" should be capitalized, and HTTP/2 has become a standard. HTTP/2 adds support for compressed HTTP headers and, more importantly, pipelining. Although my goal is to have a trim, optimized site, it's just so easy to enable that I went ahead and did it!

TLSv1.2

I found out that every major browser will drop support for TLSv1.0 and TLSv1.1 by March 2020, so now kurtmckee.org only supports TLSv1.2. I'll revisit this in the future to support TLSv1.3.

HTTP Strict Transport Security

HTTP Strict Transport Security (HSTS) is a standard that lets site operators specify that a browser should not attempt to connect through unencrypted HTTP. Once a browser receives this instruction, it should automatically upgrade all future HTTP requests to HTTPS. I added this with a sweet expiration date of 730 days!

Browsers also maintain hard-coded lists of sites that have set this flag so that the browser will never attempt to connect using HTTP. This is called "HSTS preloading". I haven't enabled it for kurtmckee.org but I'm strongly considering it.

OCSP stapling

When a user visits kurtmckee.org, their browser must contact the TLS certificate authority (in this case, Let's Encrypt) to verify that the kurtmckee.org certificate is valid. This means that, in order to improve security, the user's software must reveal that the user (or, at least, their computer or IP address) is attempting to visit my site. That's a privacy issue.

OCSP stapling resolves this by letting the kurtmckee.org server request a signed, time-stamped OCSP response and staple it to incoming TLS handshakes. My server cannot fake the response because it has to be signed by the certificate authority. This improves performance and increases privacy, and I'm pleased that my site now supports this.

CAA records

CAA records are entries in DNS that specify which certificate authorities are allowed to issue TLS certificates. The idea is that if a malicious actor attempts to hijack your site and create new certificates, their certificate authority will notice that they aren't listed as a valid certificate authority for the site and won't create a new, false certificate.

It's not foolproof, but it may be helpful so kurtmckee.org now lists Let's Encrypt as the only authorized certificate authority for the site.

Result

As a result of this work, kurtmckee.org now has an A+ rating on Qualys' SSL Server Test. Yesness!