<p>Forces all logged in users to stay on SSL connection. Guests are still served http.<br />
Just install and activate – all done!</p>
<ul>
<li>NOTE: The ‘force_ssl_admin’ and ‘force_ssl_login’ directives in ‘wp-config.php’ are not needed while using this plugin.</li>
</ul>
<h3>Features</h3>
<ul>
<li>SSL Login</li>
<li>SSL enforced for entire logged-in session</li>
<li>SSL for Admin and front-end of site</li>
<li>No messing with ‘wp-config.php’ or ‘htaccess’ directives</li>
<li>Easy to use, just install and activate on any SSL equipped site – no configuration required</li>
<li>WordPress 3.5 compatible</li>
<li>Network/Multisite compatible – can be activated on any sites in the Network, individually – sites should have a valid SSL certificate</li>
<li>Buddypress compatible</li>
<li>WP-Super-Cache compatible</li>
<li>S2Member compatible</li>
<li>Bulletproof Security compatible</li>
<li>The ‘force_ssl_admin’ and ‘force_ssl_login’ directives in ‘wp-config.php’ are not needed while using this plugin.</li>
</ul>


SSL for Logged In Users

Forces all logged in users to stay on SSL connection

shawfactor

Asitha

<p>This plugin send the proper headers for full ssl security. For more information on what this is and why it is important visit: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security</p>
<p>The options are preset to enable browsers to preload the HSTS directive but can be overwritten by filters which are clearly documented in the code.</p>
<p><strong>Did you find this plugin helpful? Please consider <a href="https://wordpress.org/support/view/plugin-reviews/lh-hsts" rel="ugc">writing a review</a>.</strong></p>
<h3>To update the max-age settings, add the following code to your functions.php</h3>
<pre><code>add_filter('lh_hsts_max_age', 'modify_ls_hsts_max_age_func');

function modify_ls_hsts_max_age_func( $max_age ){
    return false;
}
    `

<h3>To update the subdomain settings, add the following code to your functions.php</h3>

</code></pre>
<p>add_filter(‘lh_hsts_subdomain’, ‘modify_ls_hsts_subdomain_func’);</p>
<p>function modify_ls_hsts_subdomain_func( $subdomain ){<br />
    return false;<br />
}<br />
    `</p>
<h3>To update the preload setting, add the following code to your functions.php</h3>
<pre><code>add_filter('lh_hsts_preload', 'modify_ls_hsts_preload_func');

function modify_ls_hsts_preload_func( $preload ){
    return false;
}
    `

<h3>To update the redirect setting, add the following code to your functions.php</h3>

</code></pre>
<p>add_filter(‘lh_hsts_redirect’, ‘modify_ls_hsts_redirect_func’);</p>
<p>function modify_ls_hsts_redirect_func( $redirect ){<br />
    return false;<br />
}<br />
    `</p>


LH HSTS

Using with WordPress 4.9.4 and can verify the correct header is being set. Thanks!

Works Splendidly

HSTS is HTTP Strict Transport Security, a means to enforce using SSL even if the user accesses the site through HTTP and not HTTPS.

SSL for Logged In Users vs LH HSTS