diff --git a/enterprise_subsidy/settings/production.py b/enterprise_subsidy/settings/production.py
index 2abab444..aa6e8539 100644
--- a/enterprise_subsidy/settings/production.py
+++ b/enterprise_subsidy/settings/production.py
@@ -8,6 +8,14 @@
 DEBUG = False
 TEMPLATE_DEBUG = DEBUG
 
+# IMPORTANT: With this enabled, the server must always be behind a proxy that
+# strips the header HTTP_X_FORWARDED_PROTO from client requests. Otherwise,
+# a user can fool our server into thinking it was an https connection.
+# See
+# https://docs.djangoproject.com/en/dev/ref/settings/#secure-proxy-ssl-header
+# for other warnings.
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+
 ALLOWED_HOSTS = ['*']
 
 LOGGING = get_logger_config()