How to fix hsts disabled on WooCommerce

Steps for WooCommerce

1. WooCommerce runs on WordPress, so HSTS is set at the server or plugin level, not within WooCommerce itself.
2. Plugin approach (recommended for non-technical owners): Install the 'Headers Security Advanced & HSTS WP' plugin (or 'WP Force SSL & HTTPS SSL Redirect' which includes HSTS settings) from WordPress Admin → Plugins → Add New. In the plugin settings, enable HSTS and set max-age to 31536000 with 'Include Subdomains' checked.
3. Server approach (Nginx): Edit your site's Nginx config (usually in /etc/nginx/sites-available/yourdomain.conf) inside the `server { }` block for port 443 and add: `add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;` then run `nginx -t` and `systemctl reload nginx`.
4. Server approach (Apache): Add `Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"` to your VirtualHost block in your .conf file or .htaccess, then restart Apache.
5. If hosted on WP Engine, Kinsta, or SiteGround, check their control panel for a 'Security Headers' or 'HSTS' toggle, or contact their support to enable it at the server level.

Strict-Transport-Security: max-age=31536000; includeSubDomains

What is hsts disabled?

HTTP Strict-Transport-Security (HSTS) is a security header your web server sends to a visitor's browser. It tells the browser: "For the next X seconds, never connect to this site over plain HTTP — always use HTTPS, no exceptions." When HSTS is disabled or set to `max-age=0`, that instruction is removed and the browser is free to make unencrypted HTTP requests. HSTS is a one-line server response header, not a code change, but it has a significant impact on how securely shoppers connect to your store.

Without HSTS, even if your store has an SSL certificate, a customer could still land on an unencrypted HTTP version of your site — either by typing your address without "https://" or by following an old link. That window is enough for an attacker on the same network (e.g. a coffee-shop Wi-Fi) to intercept login credentials, session cookies, or payment-related data in a "man-in-the-middle" attack. Google treats HTTPS as a ranking signal and flags insecure sites in Chrome, so a missing or zeroed-out HSTS header can hurt both your search rankings and customer trust. Regulations such as PCI-DSS (required for stores handling card data) explicitly expect transport-layer protections like HSTS to be in place, and failure to comply can result in fines or loss of the ability to accept card payments.

See the complete Hsts disabled guide for every platform and the full background.