How to fix hsts disabled on WooCommerce

Steps for WooCommerce

1. WooCommerce runs on WordPress, so HSTS must be set at the web server or hosting level, not inside the WordPress admin.
2. For Apache hosting: open or create a .htaccess file in your site root (via File Manager in cPanel or via FTP) and add inside the <IfModule mod_headers.c> block: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
3. For Nginx hosting: open your server block config (e.g., /etc/nginx/sites-available/yoursite.conf) and add inside the server {} block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; — then run nginx -t and sudo systemctl reload nginx.
4. Alternatively, install the free 'Headers and Footers by WPBeginner' plugin or 'WP Headers and Footers' — however, note that PHP-level headers must be set before any output; using a caching plugin or server-level config is more reliable.
5. If you use a managed WordPress host (WP Engine, Kinsta, Flywheel), open a support ticket or use their dashboard's 'Security Headers' section — many set HSTS for you automatically.
6. Verify with DevTools or curl: curl -I https://yourdomain.com | grep -i strict

What is hsts disabled?

HTTP Strict-Transport-Security (HSTS) is a security header your web server sends to browsers. It tells the browser: "Never load this site over plain HTTP — always use HTTPS, no matter what." Once a browser sees this instruction, it enforces HTTPS automatically for the duration you specify (the max-age, measured in seconds). A max-age=0 effectively disables HSTS, meaning the browser forgets the rule immediately and offers no protection. The correct setting is max-age=31536000 (one year) with includeSubDomains so all parts of your site are covered.

Without a valid HSTS header, shoppers who type your domain into a browser or click a plain HTTP link are briefly exposed to a "downgrade attack" — a hacker on the same network (e.g., public Wi-Fi) can intercept that first unencrypted request and silently redirect them to a fake version of your store, stealing passwords, credit card numbers, or session cookies. This is classified under OWASP's A02:2021 Cryptographic Failures, one of the most exploited vulnerability categories in real-world breaches. Beyond security, Google has used HTTPS as a ranking signal since 2014, and browsers display "Not Secure" warnings that destroy shopper trust and conversion rates. Fixing HSTS is a free, low-effort change with immediate security and trust benefits.

See the complete Hsts disabled guide for every platform and the full background.