Headers
HSTS (always use HTTPS)
Tells browsers to always use the secure https:// version of your site, even if someone types or clicks an http:// link.
What it does
After a browser has visited your site once over https, HSTS makes it remember to use https only, for as long as you choose. It never tries the insecure version again in that time.
Include subdomains applies the same rule to every subdomain, such as shop.yoursite.com. Preload asks browser makers to build your site into their list, so even the very first visit is secure.
Why it matters
On public Wi-Fi, an attacker can catch the first insecure request and keep the visitor on a fake insecure copy of your site. HSTS removes that first insecure request.
Set it up
- Check your whole site works over https, including every subdomain if you plan to include them.
- Make sure HTTP Security Headers in Core headers is on.
- In section Transport security, switch on HSTS (Strict Transport Security).
- Start with a short Max age, such as 1 day or 1 week. Once you are sure nothing breaks, raise it to 1 year.
- Only switch on Include subdomains and Preload when every subdomain has a working certificate. The Preload readiness checklist helps.
- Click Save Changes.
Good to know
HSTS is hard to undo: browsers keep the rule until the max age runs out, even if you switch it off. Preload is harder still, as removal from browser lists takes months.
Submitting to the preload list is done by you at hstspreload.org; Stack Guard only adds the word to the header.
Which plan includes it
HSTS is part of Pro.
How it works, for developers
- Sends
Strict-Transport-Security: max-age=N, addingincludeSubDomainsandpreloadwhen chosen. Only sent on requests that are already https (is_ssl()), as the standard requires. - Max age choices run from 1 day to 2 years; any other value falls back to 1 year (31536000 seconds).
- Settings:
smg_hsts_enabled,smg_hsts_max_age,smg_hsts_subdomains,smg_hsts_preload. Sent onsend_headerswhilesmg_security_headersis on.
Quick answers about hsts (always use https)
What does HSTS (always use HTTPS) do in Stack Guard?
After a browser has visited your site once over https, HSTS makes it remember to use https only, for as long as you choose. It never tries the insecure version again in that time. Include subdomains applies the same rule to every subdomain, such as shop.yoursite.com. Preload asks browser makers to build your site into their list, so even the very first visit is secure.
Why use hsts (always use https) on a WordPress site?
On public Wi-Fi, an attacker can catch the first insecure request and keep the visitor on a fake insecure copy of your site. HSTS removes that first insecure request.
How do I set up hsts (always use https)?
1. Check your whole site works over https, including every subdomain if you plan to include them. 2. Make sure HTTP Security Headers in Core headers is on. 3. In section Transport security, switch on HSTS (Strict Transport Security). 4. Start with a short Max age, such as 1 day or 1 week. Once you are sure nothing breaks, raise it to 1 year. 5. Only switch on Include subdomains and Preload when every subdomain has a working certificate. The Preload readiness checklist helps. 6. Click Save Changes.
Which Stack Guard plan includes hsts (always use https)?
HSTS is part of Pro.
More in Headers
- Core security headersSends a set of standard instructions with every page, telling browsers not to show your site inside other sites, not to guess file types, and how much to reveal when visitors follow a link away.
- Content Security PolicyGives browsers a list of the places your pages may load scripts, styles, images and fonts from. Anything else, such as a script slipped in by an attacker, is refused.
- Cross-origin headersKeeps your pages and files separate from other websites: other sites cannot reach into a window your site opened, or load your files where you did not intend.
Not running Stack Guard yet? It is free.
Download Free