How to fix missing strict transport security on WooCommerce

Steps for WooCommerce

1. Log in to your WordPress admin. The HSTS header is a server-level response header, not a WordPress setting, so you must set it in one of three places.
2. Option A — via .htaccess (Apache servers): Open your root .htaccess file via FTP/SFTP or cPanel File Manager. Add the HSTS block from the Apache snippet below ABOVE the WordPress permalink block.
3. Option B — via nginx.conf (Nginx servers): SSH into your server or use your host's control panel to edit your server block config. Add the add_header line from the Nginx snippet below inside your HTTPS server {} block, then reload nginx.
4. Option C — via a WordPress plugin: Install the 'HTTP Headers' plugin (by David Gwyer) or 'Security Headers' plugin. Go to Settings → HTTP Headers (or Security Headers), find Strict-Transport-Security, enable it, set max-age to 31536000, and tick includeSubDomains.
5. Verify with browser DevTools (Network tab → click any request → Response Headers) that the header appears on all pages including the homepage, shop, and checkout.

What is missing strict transport security?

HTTP Strict Transport Security (HSTS) is a small instruction your web server sends inside every page response that tells browsers: "never load this site over plain HTTP — always use HTTPS, no exceptions." Without it, a browser will happily follow any link or redirect that starts with `http://`, even if your server immediately redirects to `https://`. That brief unencrypted moment is enough for an attacker on the same Wi-Fi network to intercept the request. The HSTS header closes that window entirely by making the browser refuse the insecure connection before it even leaves the device.

Security: Customers shopping on public Wi-Fi are vulnerable to SSL-stripping attacks — where a hacker silently downgrades their HTTPS session to plain HTTP and reads login cookies, payment info, or session tokens in the clear. HSTS prevents this. *SEO & Rankings:* Google uses HTTPS as a confirmed ranking signal and may deprioritize pages that can be reached over HTTP; a strong HSTS policy reinforces your site's "always-HTTPS" status. *Compliance & Legal:* PCI-DSS (required for any store that handles card payments) and GDPR both demand that customer data be encrypted in transit — a missing HSTS header is a finding auditors flag. *Conversions:* Browsers display security warnings for mixed-content or downgrade scenarios; even a brief warning causes visitors to abandon their cart.

See the complete Missing strict transport security guide for every platform and the full background.