# Enable HTTP Strict Transport Security (HSTS)

> Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, https, hsts, headers
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/hsts-header/

## Code

```php
add_action( 'send_headers', function () {
    if ( is_ssl() && ! headers_sent() ) {
        header( 'Strict-Transport-Security: max-age=31536000' );
    }
} );
```

## Notes

Browsers remember this header for the whole max-age, even if you disable the snippet later.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Enable HTTP Strict Transport Security (HSTS)" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/