Updated: 22 October 2026 · Applies to: WordPress, a site already fully served over HTTPS
HTTP Strict Transport Security (HSTS) tells browsers to always load your site over HTTPS, even if a visitor types or follows a plain http:// link. Only turn this on once your SSL certificate is active and every HTTP request already redirects to HTTPS; otherwise visitors who still reach an HTTP version of a page can be locked out until the header expires.
Add the header via functions.php
- Log in to wp-admin and go to Appearance > Theme File Editor.
- Select your active theme, then open
functions.php. - Add this code to the end of the file:
add_action( 'send_headers', 'tgm_io_strict_transport_security' );
function tgm_io_strict_transport_security() {
header( 'Strict-Transport-Security: max-age=10886400' );
}
Save the file. Editing the active theme's functions.php directly means this code is lost if the theme is ever updated or switched; a child theme or a small site-specific plugin avoids that, if you want the setting to survive a theme update.
Verify it
Clear any caching plugin or CDN cache first, so you are not checking a cached response. Then check the live response headers:
curl -I https://your-domain.example/
You should see Strict-Transport-Security: max-age=10886400 in the output. max-age is in seconds (10886400 is 126 days); browsers that have seen this header will refuse to load the site over plain HTTP until that time has passed, so only raise it once you are confident HTTPS will keep working.
