If you’re reading this, you’re serious about tightening up your WordPress site’s security with HTTP Strict Transport Security (HSTS) – and that’s a smart move. HSTS forces browsers to only connect via HTTPS, preventing downgrade attacks on your visitors.
The catch is there’s no going back once you enable it. If your SSL certificate expires or breaks in any way, your site will become unreachable. So, this isn’t something you’d enable on a whim.
In this guide, you’ll get step-by-step instructions for multiple proven methods of setting up HSTS on WordPress: manual configuration, the plugin route, and Cloudflare’s automatic handling. Each method has its nuances, but all are effective for a secure implementation.
Before diving in, ensure you have a valid SSL certificate and a clear testing plan. HSTS might be straightforward, but it’s also unforgiving. Do it right, and it’ll significantly strengthen your site’s security – do it wrong, and you risk taking your site offline.
Understanding the benefits and drawbacks of HSTS for WordPress
Implementing HSTS on your WordPress site can really elevate your security, but it’s not without its trade-offs. Understanding both the benefits and drawbacks is key to deciding whether it’s the right move for you.
Some of the benefits of enabling HSTS on WordPress are as follows:
- HSTS prevents downgrade attacks by forcing browsers to always use HTTPS, ensuring encrypted connections at all times.
- It boosts trust and SEO by aligning with Google’s preference for HTTPS. Sites with HSTS enabled tend to rank better and are seen as more secure by users.
- Once HSTS is enabled, HTTPS is enforced automatically, removing the possibility of users accidentally accessing the HTTP version of your site.
However, there are some real drawbacks:
- If your SSL certificate fails or expires, your site will be unreachable since HSTS prevents fallback to HTTP.
- Once HSTS is activated, especially with preload, removing it is complicated and can take time to propagate across browsers.
- Setting up HSTS properly, particularly through methods like .htaccess or Cloudflare, can be tricky for non-technical users. A misconfiguration could break access to your site.
Step-by-step guide to implementing HSTS in WordPress
Each method for implementing HSTS has its own strengths depending on your technical needs and site setup. Before you flip the switch, double-check that SSL is enabled with a valid certificate and that every piece of content loads over HTTPS. One mistake, and you’re looking at a potential site lockout.
Option 1: Manual implementation via .htaccess
To implement HSTS in WordPress via the .htaccess file, start by backing it up – if anything goes wrong, you’ll need a restore point.
Once backed up, access the root .htaccess file through SFTP or your hosting file manager. Add this directive:
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
This enforces HTTPS for one year – 31,536,000 seconds – applies HSTS to all subdomains, and sets your site up for the HSTS preload list. After adding the directive, test it using a tool like Security Headers to ensure the header is being sent correctly.
Finally, monitor your site’s access logs for any issues. If there’s a misconfiguration – like an expired SSL certificate – you risk locking users out.
Again, HSTS is powerful, but unforgiving.
Option 2: Using a plugin
If you’re uncomfortable doing it manually, there’s always the plugin route. In this case, it’s Headers Security Advanced & HSTS WP.
Sadly, this plugin won’t be winning awards for its name anytime soon, but it’s beginner-friendly and functionality is solid. Here’s what you need to do to enable HSTS:
1. With the plugin downloaded and activated, go to Settings > Headers Security Advanced & HSTS WP.
2. Scroll to the Quick selection section and click on Strict Transport Security (HSTS).
3. Set the Max-Age value, which is in seconds, to 31536000 for one year.
4. Check the Enable include subdomains and Enable preload options if you want. Luckily, the UI does a good job of explaining what each option does.
5. Scroll to the bottom and click Save Changes when finished.
Option 3: Enabling HSTS through Cloudflare
Activating HSTS for your WordPress site through Cloudflare offers the best balance of security and ease.
Cloudflare manages HSTS settings at the edge of your network, meaning no need to modify your server or plugin settings. It’s an efficient solution, particularly for sites with high traffic or those looking for a more hands-off approach.
Here’s how you can enable it through Cloudflare’s dashboard:
- Open your Cloudflare account, then go to your site’s settings.
- Switch to the SSL/TLS tab then scroll down until you find the HSTS Strict Transport Security (HSTS) section. Click the button labeled Enable HSTS.
- Scroll to the bottom of the text in the Acknowledgement tab, check the box labeled I understand, then click Next.
- When you’re moved to the Configure tab, toggle Enable HSTS on then set your preferred Max Age Header value.
- Toggle the other options on or leave them off as needed then click Save when you’re done.
Cloudflare does the best job of explaining things within its UI, so it’s our recommended option for beginners. For example, the Acknowledgement section provides an exhaustive explainer of the risks of enabling HSTS.
Moreover, unlike the other methods, the max age values are made clearer with a dropdown that labels them more naturally, i.e., as months, and gives you a recommendation of six.
How to submit a site to the HSTS preload list
The HSTS preload list is a powerful security feature built into major browsers like Chrome, Firefox, and Safari.
Domains on this list are automatically forced to use HTTPS, even before users visit the site for the first time. Essentially, browsers treat these sites as always requiring a secure connection, protecting them from downgrade attacks and man-in-the-middle exploits.
Once a domain is added to the list, it’s hard coded into the browser, so HTTPS is enforced immediately without any user intervention.
To submit, head over to hstspreload.org and enter your domain. The tool will run a series of checks to ensure your SSL certificate is valid, HTTPS is enforced across all subdomains, and the HSTS header is configured correctly with max-age ≥ 1 year, includeSubDomains, and preload.
If everything checks out, your domain gets added to Chrome’s preload list and eventually propagates to other browsers. Expect a delay of a few weeks for full rollout.
Once you’re on the list, though, it’s almost impossible to remove. So, make sure your SSL and HTTPS setup are flawless before submitting – otherwise, you risk locking your site out of reach of your users.
WordPress security beyond HSTS with Shield Security PRO
HSTS is a critical security header that forces browsers to always use HTTPS, but it’s just one part of a broader security strategy. Shield Security PRO’s advanced HTTP headers feature builds on HSTS to offer even more granular control over how browsers interact with your site.
The Block iFrames option stops clickjacking by blocking your site from being embedded in malicious iframes. With custom rules, you can enable Content-Security-Policy (CSP) headers to stop malicious scripts from executing by specifying where resources can be loaded from – reducing the risk of cross-site scripting (XSS) attacks.
Beyond security headers, Shield Security PRO offers a range of complementary features.
The Security Admin feature locks site-critical settings behind a PIN, while brute force protection blocks login attempts from malicious bots. Two-factor authentication adds an extra layer of defence, making it harder for attackers to gain access even with stolen credentials.
Together, these features create a comprehensive security suite that pairs perfectly with HSTS, making your WordPress site tough to compromise.
Secure your WordPress site with Shield Security PRO today!
Implementing HSTS is an excellent first step in securing your WordPress site – you’re locking down HTTPS and ensuring encrypted communication. While HSTS handles protocol-level security, though, it doesn’t protect against the broader threats that constantly target WordPress sites – malware, brute force attacks, and bot-driven exploits.
That’s why you need Shield Security PRO – the next logical step for anyone serious about security.
Beyond securing your traffic, the plugin offers automatic malware scanning and removal via MAL{ai}, ensuring malicious code doesn’t slip through the cracks. Its silentCAPTCHA technology intelligently blocks malicious bots without impacting real users, while advanced login protection (including two-factor authentication) ensures only authorised users can get in.
When combined with HSTS, these features create a truly comprehensive security solution for your WordPress site.
To take the next step, check out Shield Security PRO today!
