shawfactor

Asitha

This plugin send the proper headers for full ssl security. For more information on what this is and why it is important visit: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
The options are preset to enable browsers to preload the HSTS directive but can be overwritten by filters which are clearly documented in the code.
Did you find this plugin helpful? Please consider <a href="https://wordpress.org/support/view/plugin-reviews/lh-hsts" rel="ugc">writing a review</a>.
<h3>To update the max-age settings, add the following code to your functions.php</h3>
<pre><code>add_filter('lh_hsts_max_age', 'modify_ls_hsts_max_age_func');

function modify_ls_hsts_max_age_func( $max_age ){
 return false;
}
 `

<h3>To update the subdomain settings, add the following code to your functions.php</h3>

</code></pre>
add_filter(‘lh_hsts_subdomain’, ‘modify_ls_hsts_subdomain_func’);
function modify_ls_hsts_subdomain_func( $subdomain ){ 
 return false; 
} 
 `
<h3>To update the preload setting, add the following code to your functions.php</h3>
<pre><code>add_filter('lh_hsts_preload', 'modify_ls_hsts_preload_func');

function modify_ls_hsts_preload_func( $preload ){
 return false;
}
 `

<h3>To update the redirect setting, add the following code to your functions.php</h3>

</code></pre>
add_filter(‘lh_hsts_redirect’, ‘modify_ls_hsts_redirect_func’);
function modify_ls_hsts_redirect_func( $redirect ){ 
 return false; 
} 
 `

LH HSTS

Using with WordPress 4.9.4 and can verify the correct header is being set. Thanks!

Works Splendidly

Not only does this not work - YOU CANNOT DISABLE OR REMOVE HSTS after this plugin!

I can't access my website anymore, because this 'author' made it impossible to remove or disable hsts - I disabled and removed the plugin, cleared cache, rebooted the server - HSTS is still on!!!!!!

completely broken

HSTS is HTTP Strict Transport Security, a means to enforce using SSL even if the user accesses the site through HTTP and not HTTPS.

Jay Suthar

BoundaryGuard Headers enforces modern HTTP security headers to harden your WordPress site against XSS, clickjacking, mixed content, and cross-origin attacks.
Key Features:
<ul>
<li>Essential Protection: Adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy to reduce attack surface and prevent clickjacking.</li>
<li>HSTS (Strict Transport Security): Forces HTTPS connections to help prevent protocol downgrade and man-in-the-middle attacks.</li>
<li>Advanced Isolation (COOP/COEP): Enables Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy to improve cross-origin isolation and mitigate certain side-channel attacks.</li>
<li>Content Security Policy (CSP): One of the strongest defenses against XSS. Includes a dashboard-based CSP builder with preset options to whitelist trusted sources for scripts, styles, images, and more.</li>
<li>CSP Report-Only Mode: Test your policy safely without blocking content.</li>
<li>Server Header Hardening: Removes or limits exposure of headers such as <code>X-Powered-By</code> and <code>Server</code>.</li>
<li>Lightweight and Fast: Uses PHP headers for broad server compatibility and minimal performance impact.</li>
<li>No <code>.htaccess</code> Editing Required: Works without modifying server configuration files.</li>
</ul>
Designed for developers and site owners who want stronger security without unnecessary complexity.
<h3>External Services</h3>
This plugin provides a Content Security Policy (CSP) builder. To assist users, it includes “Preset Buttons” that allow users to quickly add domain names to their own CSP whitelist.
This plugin DOES NOT connect to, load data from, or send data to these services automatically. The following third-party domains are referenced as presets within the admin dashboard for whitelisting purposes: 
* Google Analytics (www.google-analytics.com) – Used for tracking whitelisting. [Privacy: https://policies.google.com/privacy] 
* Google Tag Manager (www.googletagmanager.com) – Used for tag management. [Privacy: https://policies.google.com/privacy] 
* Stripe (js.stripe.com, api.stripe.com) – Used for payment processing. [Privacy: https://stripe.com/privacy] 
* Facebook (www.facebook.com, connect.facebook.net) – Used for social embeds. [Privacy: https://www.facebook.com/policy.php] 
* YouTube (www.youtube.com, i.ytimg.com) – Used for video embeds. [Privacy: https://policies.google.com/privacy] 
* Vimeo (player.vimeo.com) – Used for video embeds. [Privacy: https://vimeo.com/privacy] 
* Gravatar (secure.gravatar.com) – Used for user avatars. [Privacy: https://automattic.com/privacy/]

BoundaryGuard Headers

Automatically enforces essential HTTP security headers to protect your site from XSS, clickjacking, and protocol downgrade attacks.

LH HSTS vs BoundaryGuard Headers