The Strict-Transport-Security header (HSTS) tells browsers to only ever connect to your site over a secure HTTPS connection. Once a browser has seen this header, it will automatically use HTTPS for every future visit — even if someone types or clicks a plain http:// link. Right now your site isn't sending this instruction, so browsers have no standing rule to enforce.
Why it matters
The very first time someone visits your site, their request may go out over insecure HTTP before your server redirects them to HTTPS. In that brief window, an attacker on the same network can intercept the connection or hijack the redirect. HSTS closes that gap by telling the browser to skip the insecure request entirely.
How to fix it
Add the following header to your site's responses. The max-age value is in seconds; 31536000 is one year.
Strict-Transport-Security: max-age=31536000; includeSubDomains
Only add includeSubDomains if every subdomain on your domain is served over HTTPS, otherwise those subdomains will become unreachable.
WordPress
If your host doesn't offer a header setting, add this to your theme's functions.php (or use a headers plugin):
add_action('send_headers', function () {
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
});
Nginx
Add this inside the server block that handles HTTPS (port 443), then reload Nginx:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Apache
Ensure mod_headers is enabled, then add this to your virtual host or .htaccess:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Cloudflare
Go to SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS), enable it, and set Max Age to 12 months. Confirm HTTPS is fully working on your site before turning this on.
How to check it worked
Reload your site and look at the response headers in your browser's developer tools (Network tab), or run curl -I https://yourdomain.com — you should see the Strict-Transport-Security line in the output.