Add the Strict-Transport-Security (HSTS) header on WordPress

Why it matters

Without HSTS, a browser that is sent to the http:// address first can be intercepted before it reaches the secure site. The header tells browsers to use HTTPS only, for as long as you specify.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. First make sure the site works over HTTPS. The WordPress Address and Site Address under Settings then General start with https://, and there is no mixed content.
2. Set the header at the web server. On Apache hosting add the lines to .htaccess above the WordPress block. On nginx hosting add the add_header line to the server block. On managed WordPress hosting, look for a security headers or HSTS setting in the host's dashboard, or ask their support.
3. Raise max-age in the stages from the generic steps (86400, then 2592000, then 31536000).

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=300"
</IfModule>

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Decide whether to add includeSubDomains
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list