Edit HSTS header

themew

Currently, Wordpress headers only display: strict-transport-security max-age=63072000

However, for full HSTS validation, we need: max-age=31536000; includeSubDomains; preload

otherwise HSTS fails. Verification : https://hstspreload.org/

Is it possible to edit the header when WP AutoShield is being used to add the above to the security headers?

cPFence

themew Is it possible to edit the header when WP AutoShield is being used to add the above to the security headers?

Yes, you can use this plugin or a similar one to customize the security headers according to your needs:
https://wordpress.org/plugins/headers-security-advanced-hsts-wp/

themew

cPFence Thanks for the reply. I was hoping to edit the current header that WP Autoshield does a great job of generating rather than using a plugin. The header is great, it's just missing the additional code to satisfy HSTS.

cPFence

themew

Sorry, it’s risky to roll this out globally by default. includeSubDomains means every subdomain under that hostname must be reachable over HTTPS, and preload is a strong commitment. If a domain gets into the browser preload list, undoing it is slow and painful and can take months to reach users via browser updates. Editing it directly in cPFence is possible, but your changes will be overwritten on the next update. Our recommendation is to use the plugin we shared above and apply the change only to domains you are ready to commit to.

themew

I understand and completely agree with your assessment. Thank you for your explanation and for creating such a great product.