[rhoml]

Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.

[d0ugie]

Is there any downside, when using SSL, in enabling perfect forward secrecy?

[JshWright]

Make sure you're using an SSL library that support ECDHE cipher suites... the non EC suites are very slow.