Flash Sale:75% Off Hosting + Free DomainEnds in13h47m14sView Plans
Hostvento logoHostvento
Get Started

Add HSTS to Your WordPress Site

Make browsers always use HTTPS for your site. Three ways: a plugin, Cloudflare, or the .htaccess file.

SSL and Security3 min read14 steps10 screenshots

What is HSTS?

HSTS stands for HTTP Strict Transport Security. It tells the browser to open your site only over HTTPS. Even if a visitor types http://, the browser switches to https:// by itself. This helps stop man-in-the-middle attacks, protocol downgrade and cookie theft.

Note: Install an SSL certificate first. HSTS only works when HTTPS already works on your whole site.
HSTS protects the connection to a WordPress site

The header uses three settings:

SettingWhat it does
max-ageHow long, in seconds, the browser must use HTTPS. 63072000 is two years.
includeSubDomainsAlso applies the rule to all subdomains.
preloadLets browsers enforce HTTPS even on the first visit.

A full header looks like this:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Method 1: Use the All in One SEO plugin

The security header feature is in the premium version of the plugin.

  1. Install the All in One SEO plugin.
    Installing the All in One SEO plugin
  2. Activate it.
    Activating the plugin
  3. Go to All in One SEO, then Redirects. Click Activate Redirects.
    The Activate Redirects button
  4. Open the Full Site Redirect tab. Scroll to Canonical Settings and turn it on. Click Add Security Presets.
    The Add Security Presets button
  5. A table of recommended headers appears. Change them if you need to.
    The HTTP security headers table
  6. Click Save Changes, then check your site.

Method 2: Use Cloudflare

  1. Connect your site to Cloudflare (change your nameservers to the ones Cloudflare gives you).
  2. In Cloudflare, go to SSL/TLS, then Edge Certificates.
    Edge Certificates in Cloudflare
  3. Find HTTP Strict Transport Security (HSTS) and click Enable HSTS.
    The Enable HSTS button
  4. Read the warning, then click Next. Choose the options you want: HSTS, subdomains, preload and the no-sniff header.
    The HSTS options in Cloudflare

Method 3: Edit the .htaccess file

This works on Apache servers. Back up your site first.

  1. Open your site files with FTP or File Manager. Go to the root folder.
  2. Open .htaccess in a text editor.
    The .htaccess file in the site root
  3. Add this block at the bottom:
<IfModule mod_headers.c>
  Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
  Header set X-XSS-Protection "1; mode=block"
  Header set X-Content-Type-Options nosniff
  Header set X-Frame-Options DENY
  Header set Referrer-Policy "no-referrer-when-downgrade"
</IfModule>
  1. Save the file and open your site to make sure it still loads.

What the other headers do

  • X-XSS-Protection blocks some cross-site scripting attacks.
  • X-Frame-Options stops other sites from showing yours in a frame (clickjacking).
  • X-Content-Type-Options stops browsers from guessing file types.
  • Referrer-Policy controls how much address data is sent to other sites.
Warning: Start with a short max-age. A long value, plus preload, is hard to undo if HTTPS breaks later.

Quick recap

  • HSTS forces HTTPS in the browser.
  • Use a plugin, Cloudflare, or .htaccess.
  • Test your site after every change.