Enable HTTP Strict Transport Security (HSTS)
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
Opens WPIDE on
Code
add_action( 'send_headers', function () {
if ( is_ssl() && ! headers_sent() ) {
header( 'Strict-Transport-Security: max-age=31536000' );
}
} );Notes
Browsers remember this header for the whole max-age, even if you disable the snippet later.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.