kevin

This plugin enables WordPress to send HSTS header to browser
IMPORTANT NOTE: This plugin won’t work if you use any WordPress caching plugin. If this is the case, then update your .htaccess file to specify HSTS header.
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking.
It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only secure HTTPS connections, and never via the insecure HTTP protocol

Simple HSTS Preload

This plugin enables HSTS header on WordPress

WP Fix It - WordPress Experts

WP Fix It Easy Security Headers adds a simple page under Tools → Security Headers where you can toggle common HTTP security headers:
<ul>
<li>Strict-Transport-Security (HSTS)</li>
<li>Content-Security-Policy (CSP)</li>
<li>X-Frame-Options</li>
<li>X-Content-Type-Options</li>
<li>Referrer-Policy</li>
<li>Permissions-Policy</li>
</ul>
On activation, all headers are enabled by default and you’re redirected to the settings screen.
For convenience, the page and the Plugins screen include a “Check Headers” button that opens SecurityHeaders.com with your site’s URL prefilled (built dynamically from <code>home_url()</code>).
<h3>Notes on CSP</h3>
This plugin ships with a permissive default CSP intended to “work everywhere” out of the box (allows most external sources and inline code). For stronger protection, you should harden the directives for your specific site.
<h3>Key Features</h3>
<ul>
<li>One-click toggles for popular headers</li>
<li>Dynamic “Check Headers” scan link</li>
<li>Uses the WordPress Settings API (nonce + capability checks)</li>
<li>Output escaping and sanitization following PHPCS</li>
</ul>

Fix It Easy Security Headers

Configure core HTTP security headers for your WordPress site in a few clicks.

Simple HSTS Preload vs Fix It Easy Security Headers