How to Enable HSTS to Enforce HTTPS
What is HSTS?
HSTS (HTTP Strict Transport Security) is a security header that tells browsers to always connect to your website over HTTPS, never plain HTTP. Without it, a visitor’s very first request to your domain could theoretically be intercepted before the redirect to HTTPS happens.
Security scanning tools (such as CyberAlarm) commonly flag sites that don't send an HSTS header, even if the site already redirects HTTP to HTTPS. This is a best-practice recommendation rather than evidence of an active vulnerability.
How it's enabled
HSTS is switched on at server/hosting level, not from within WordPress, so this isn’t something you can toggle yourself from the dashboard.
- Raise a support ticket with your Innermedia support team and let them know a scan has flagged missing HSTS.
- We’ll confirm your site is running fully on HTTPS with no mixed content, then enable the HSTS header at the hosting level.
- Once live, you can re-run your security scanner or check the header using a tool such as securityheaders.com to confirm it’s present.
Once HSTS is enabled, your site cannot be served over plain HTTP again for the duration set by the header — so this is only turned on once HTTPS is confirmed to be working correctly across the whole site.
Was this article helpful?