Enable HSTS to enforce HTTPS

HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS for your domain, even if someone types http:// or clicks an old link. It closes the short window before a redirect where an attacker on the same network could intercept the first plain-HTTP request. It is powerful, and hard to undo, so roll it out in stages.

Before you start

• Every hostname you will include must have a valid certificate that renews reliably. Check cPanel → Security → SSL/TLS Status.
• HTTP must already redirect to HTTPS (cPanel → Domains → Domains → Force HTTPS Redirect).
• Know all your subdomains, including ones used for mail, staging or third-party services.

How HSTS works

The server sends a response header over HTTPS. The browser remembers it for max-age seconds and, during that time, refuses to connect to the domain over HTTP and does not let visitors click through certificate errors. If your certificate breaks during that period, visitors cannot reach the site at all until it is fixed.

Add the header

Edit .htaccess in the site's document root via cPanel → Files → File Manager and add near the top:

<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=300"
</IfModule>

Start with a short max-age of five minutes. Browse the site and subdomains for a few days, then increase step by step.

Roll out in stages

Include subdomains

Adding includeSubDomains applies the policy to every subdomain:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Only add it when every subdomain, including ones hosted elsewhere, serves valid HTTPS. A forgotten subdomain on an old HTTP-only service becomes unreachable for visitors who have the policy cached.

Preloading: think twice

The preload directive and submission to the browser preload list build HSTS into browsers themselves, protecting even the very first visit. Removal from the list takes months to reach all users. Only preload if you are sure the domain and all subdomains will use HTTPS permanently.

Check the header

• In the browser press F12, open Network, click the page request and look for strict-transport-security in the response headers.
• From a terminal: curl -sI https://example.com | grep -i strict.

WordPress and plugins

Some security plugins can add HSTS for you. Use either the plugin or .htaccess, not both, to avoid duplicate headers with different values.

Undoing HSTS

Send max-age=0 over HTTPS. Browsers that see it forget the policy. Visitors who do not return keep the old policy until their stored max-age runs out, which is why you start small.

Troubleshooting

• Header not present: the rule sits in a different .htaccess than the one serving the site, or the response comes from a CDN that strips or overrides it.
• Subdomain unreachable after enabling: remove includeSubDomains, send max-age=0, and fix that subdomain's certificate.

Next steps

• Force HTTPS in WordPress
• Check an installed certificate
• WordPress security hardening