aaron44126

Note: WordPress 3.3 offers a new, non-Flash uploader; this plugin may break it.
If you are using SSL (https) to secure your WordPress admin sessions and you 
have an SSL certificate that is not trusted by default (because it is self- 
signed, signed by an untrusted certificate authority, signed for a different 
domain name, etc.), then you probably have problems using the Flash uploader.
This plugin disables SSL usage by the Flash uploader. This allows you to use 
the Flash uploader when you have FORCE_SSL_ADMIN enabled, with an untrusted SSL 
certificate. This works around the vague “IO Error” you get from the Flash 
uploader in such a situation.
Note that this plugin comes with the following security implications:
<ul>
<li>Flash uploads no longer use SSL, thus, your uploaded files aren’t encrypted 
during transmission.</li>
<li>Uploading files with the Flash uploader will transmit your WordPress 
authentication cookie in plain text.</li>
<li>If someone captures your login cookie (which is transmitted any time you load 
a page on your WordPress site while logged in, whether you are using SSL or 
not), they may be able to use it to upload files, view information about 
uploaded files, or change information about uploaded files.</li>
</ul>
If the benefit of having the Flash uploader available outweighs these potential 
security risks for you, then you can use this plugin to enable the Flash 
uploader.
Note that this plugin override’s WordPress’s auth_redirect and 
wp_validate_auth_cookie functions, and may not work if you are using other 
plugins that override these functions.

NO SSL Flash Upload

Turns off SSL for the Flash uploader when you have FORCE_SSL_ADMIN enabled, in case you are having trouble getting it to work ("IO Error").

shawfactor

Asitha

This plugin send the proper headers for full ssl security. For more information on what this is and why it is important visit: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
The options are preset to enable browsers to preload the HSTS directive but can be overwritten by filters which are clearly documented in the code.
Did you find this plugin helpful? Please consider <a href="https://wordpress.org/support/view/plugin-reviews/lh-hsts" rel="ugc">writing a review</a>.
<h3>To update the max-age settings, add the following code to your functions.php</h3>
<pre><code>add_filter('lh_hsts_max_age', 'modify_ls_hsts_max_age_func');

function modify_ls_hsts_max_age_func( $max_age ){
 return false;
}
 `

<h3>To update the subdomain settings, add the following code to your functions.php</h3>

</code></pre>
add_filter(‘lh_hsts_subdomain’, ‘modify_ls_hsts_subdomain_func’);
function modify_ls_hsts_subdomain_func( $subdomain ){ 
 return false; 
} 
 `
<h3>To update the preload setting, add the following code to your functions.php</h3>
<pre><code>add_filter('lh_hsts_preload', 'modify_ls_hsts_preload_func');

function modify_ls_hsts_preload_func( $preload ){
 return false;
}
 `

<h3>To update the redirect setting, add the following code to your functions.php</h3>

</code></pre>
add_filter(‘lh_hsts_redirect’, ‘modify_ls_hsts_redirect_func’);
function modify_ls_hsts_redirect_func( $redirect ){ 
 return false; 
} 
 `

LH HSTS

Using with WordPress 4.9.4 and can verify the correct header is being set. Thanks!

Works Splendidly

Not only does this not work - YOU CANNOT DISABLE OR REMOVE HSTS after this plugin!

I can't access my website anymore, because this 'author' made it impossible to remove or disable hsts - I disabled and removed the plugin, cleared cache, rebooted the server - HSTS is still on!!!!!!

completely broken

HSTS is HTTP Strict Transport Security, a means to enforce using SSL even if the user accesses the site through HTTP and not HTTPS.

NO SSL Flash Upload vs LH HSTS