shawfactor

Asitha

<p>This plugin send the proper headers for full ssl security. For more information on what this is and why it is important visit: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security</p>
<p>The options are preset to enable browsers to preload the HSTS directive but can be overwritten by filters which are clearly documented in the code.</p>
<p><strong>Did you find this plugin helpful? Please consider <a href="https://wordpress.org/support/view/plugin-reviews/lh-hsts" rel="ugc">writing a review</a>.</strong></p>
<h3>To update the max-age settings, add the following code to your functions.php</h3>
<pre><code>add_filter('lh_hsts_max_age', 'modify_ls_hsts_max_age_func');

function modify_ls_hsts_max_age_func( $max_age ){
    return false;
}
    `

<h3>To update the subdomain settings, add the following code to your functions.php</h3>

</code></pre>
<p>add_filter(‘lh_hsts_subdomain’, ‘modify_ls_hsts_subdomain_func’);</p>
<p>function modify_ls_hsts_subdomain_func( $subdomain ){<br />
    return false;<br />
}<br />
    `</p>
<h3>To update the preload setting, add the following code to your functions.php</h3>
<pre><code>add_filter('lh_hsts_preload', 'modify_ls_hsts_preload_func');

function modify_ls_hsts_preload_func( $preload ){
    return false;
}
    `

<h3>To update the redirect setting, add the following code to your functions.php</h3>

</code></pre>
<p>add_filter(‘lh_hsts_redirect’, ‘modify_ls_hsts_redirect_func’);</p>
<p>function modify_ls_hsts_redirect_func( $redirect ){<br />
    return false;<br />
}<br />
    `</p>


LH HSTS

Using with WordPress 4.9.4 and can verify the correct header is being set. Thanks!

Works Splendidly

Not only does this not work - YOU CANNOT DISABLE OR REMOVE HSTS after this plugin!

I can't access my website anymore, because this 'author' made it impossible to remove or disable hsts - I disabled and removed the plugin, cleared cache, rebooted the server - HSTS is still on!!!!!!

completely broken

HSTS is HTTP Strict Transport Security, a means to enforce using SSL even if the user accesses the site through HTTP and not HTTPS.

WP Fix It - WordPress Experts

<p><strong>WP Fix It Easy Security Headers</strong> adds a simple page under <strong>Tools <span aria-hidden="true" class="wp-exclude-emoji">→</span> Security Headers</strong> where you can toggle common HTTP security headers:</p>
<ul>
<li><strong>Strict-Transport-Security (HSTS)</strong></li>
<li><strong>Content-Security-Policy (CSP)</strong></li>
<li><strong>X-Frame-Options</strong></li>
<li><strong>X-Content-Type-Options</strong></li>
<li><strong>Referrer-Policy</strong></li>
<li><strong>Permissions-Policy</strong></li>
</ul>
<p>On activation, all headers are <strong>enabled by default</strong> and you’re redirected to the settings screen.</p>
<p>For convenience, the page and the Plugins screen include a <strong>“Check Headers”</strong> button that opens SecurityHeaders.com with your site’s URL prefilled (built dynamically from <code>home_url()</code>).</p>
<h3>Notes on CSP</h3>
<p>This plugin ships with a <strong>permissive</strong> default CSP intended to “work everywhere” out of the box (allows most external sources and inline code). For stronger protection, you should harden the directives for your specific site.</p>
<h3>Key Features</h3>
<ul>
<li>One-click toggles for popular headers</li>
<li>Dynamic “Check Headers” scan link</li>
<li>Uses the WordPress Settings API (nonce + capability checks)</li>
<li>Output escaping and sanitization following PHPCS</li>
</ul>


Fix It Easy Security Headers

Configure core HTTP security headers for your WordPress site in a few clicks.

LH HSTS vs Fix It Easy Security Headers