How to Add HSTS to Your WordPress Site

Keeping data secure is an essential task for WordPress site owners. One important step in this process is using HTTP Strict Transport Security (HSTS). It helps us enforce HTTPS connections and add a layer of protection against threats like man-in-the-middle attacks and cookie hijacking. If you’ve recently installed an SSL certificate on your WordPress site, setting up the HSTS header is a smart next move. While it may seem technical, adding this header is easier than it looks and is key to protecting your visitors.

In this guide, you’ll learn how to add HTTP security headers to your WordPress site by using plugins or editing configuration files directly.

What is the HTTP Strict Transport Security Header

HSTS is a security feature that tells browsers to use HTTPS when connecting to your WordPress site. It works alongside your SSL certificate to ensure all communication between your site and users remains encrypted. It prevents common attacks such as man-in-the-middle, protocol downgrade, and cookie hijacking.

HSTS ensures that even if someone types your site’s address with “http://”, the browser automatically switches to “https://”. This practice protects users from unsafe connections and stops attackers from intercepting data.

Key HSTS Settings

HSTS uses three main directives that are listed below:

1. max-age: Sets how long the browser should enforce HTTPS. This value is in seconds and can range from 0 (disabled) to over two years (e.g., 63072000 seconds).
2. includeSubDomains: If enabled, HSTS also applies to all subdomains, not just the main site.
3. preload: Adds your site to browser preload lists so that HTTPS is enforced even on a user’s first visit.

To configure HSTS, you’ll need to update your web server settings. When enabled correctly, it shows up in your response header as: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Adding HSTS to Your WordPress Site Using AIOSEO

All in One SEO (AIOSEO) is a popular WordPress plugin used by millions of website owners to improve their SEO. With the premium version, you can also add HTTP security headers to your site without any code. To get started, install the AIOSEO plugin on your WordPress site:

After installation, make sure to activate the AIOSEO plugin:

Once the plugin is active, go to All in One SEO > Redirects in your WordPress dashboard. Then, click the “Activate Redirects” button to turn on the redirects feature, which also allows you to manage and add HTTP security headers:

After turning on the redirects feature, go to the Full Site Redirect tab. Then scroll down until you see the Canonical Settings section. Turn on the Canonical Settings option by switching the toggle, and after that, click the Add Security Presets button to apply the recommended security headers:

A list of recommended HTTP security headers will now appear in a table. These headers are already set up to protect your website. You can look through them and make changes if you want to adjust the settings:

Finally, click the Save Changes button to apply the security headers. After saving, visit your website to check that everything is working correctly.

How to Use Cloudflare to Add HSTS to a WordPress Website

Cloudflare provides a free service that includes a basic website firewall and content delivery network (CDN) to help speed up and protect your site. However, if you’re looking for more advanced security features like more detailed protection rules or enhanced bot management, you’ll need to upgrade to their Pro plan, which comes at a higher cost.

To install Cloudflare on your WordPress site, set up the free Cloudflare CDN, update your domain’s nameservers, and adjust basic settings to get your site connected and protected.

Once Cloudflare is set up and running on your site, log in to your Cloudflare dashboard. From there, go to the SSL/TLS section in the left-hand menu. Then, click on the Edge Certificates tab. This is where you’ll find important HTTPS and HSTS settings to help secure traffic between your users and your site:

Scroll down until you see the “HTTP Strict Transport Security (HSTS)” section, then click the “Enable HSTS” button to turn it on:

A message will appear letting you know that HTTPS must be active on your site before using this feature. If your WordPress blog already uses HTTPS, just click the “Next” button to proceed. You’ll then see options to add HTTP security headers:

Now you can enable HSTS, apply it to subdomains (if they use HTTPS), preload HSTS, and turn on the no-sniff header.

Adding HSTS Header to Your WordPress Site Using .htaccess

Adding an HSTS header using the .htaccess file lets you add security headers to your WordPress site directly through your server settings. To do this, you’ll need to edit the .htaccess file, which is a configuration file used by most websites running on the Apache server. However, before you make any changes, make sure to take a backup of your website.

Start by connecting to your site using an FTP client or the file manager provided by your hosting service. Once connected, go to your website’s root directory, look for the .htaccess file, and open it using a text editor:

Scroll to the bottom of the file, and you can insert code that adds HTTPS-related security headers:

<IfModule mod_headers.c>
  Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
  Header set X-XSS-Protection "1; mode=block"
  Header set X-Content-Type-Options nosniff
  Header set X-Frame-Options DENY
  Header set Referrer-Policy: no-referrer-when-downgrade
</IfModule>

After this, save the file, and then check your website to make sure everything is still working properly. 

How HTTP Security Headers Protect Your Site

HTTP security headers add extra protection by controlling how browsers handle your site’s content. They are part of the response your server sends when someone visits your site and can prevent many common threats. Common security headers include:

• Strict-Transport-Security (HSTS): Forces HTTPS connections.
• X-XSS-Protection: Blocks cross-site scripting attacks.
• X-Frame-Options: Prevents your site from being loaded in iframes on other domains (helps stop clickjacking).
• X-Content-Type-Options: Stops browsers from guessing the content type (prevents certain exploits).

For best results, set these headers at the server level. If you’re using services like Cloudflare or Sucuri, they can also help enforce these rules early in the request process.

Conclusion

Securing your WordPress site is essential to protect both your data and your visitors. One effective way to do this is by enabling HTTP Strict Transport Security (HSTS), which forces browsers to use secure HTTPS connections. You can implement HSTS and other HTTP security headers, such as X-XSS-Protection and X-Frame-Options, to protect your site from common online threats. You can add these headers manually through the .htaccess file, using plugins like AIOSEO, or rely on services like Cloudflare. In this write-up, we explained all these methods to add HSTS to your WordPress site.

FAQ