What Is HSTS and How to Enable It (Speed, SEO and Security)

HSTS (HTTP Strict Transport Security) is a small security header that tells browsers your site must only ever be loaded over HTTPS. Once a visitor’s browser has seen it, every future visit goes straight to the secure version of your site, even if someone types or clicks an old http:// link.

It takes a couple of minutes to switch on, and it helps in three ways: security, SEO and speed. It’s now considered standard security practice, so if your site doesn’t send the header, security scanners will mark it down.

How HSTS works

Without HSTS, when someone visits http://yoursite.com the browser sends that request over the internet unencrypted. Your server then replies with a redirect to the HTTPS version. That first request is the weak spot: it’s sent in plain text, and it costs an extra round trip before the page starts to load.

With HSTS, your server sends a Strict-Transport-Security header on every HTTPS response. The browser stores that rule for as long as the header’s max-age says (six months, for example). From then on:

• The browser upgrades the request itself. If you type or click an http:// link, the browser rewrites it to https:// before anything is sent. In Chrome’s developer tools this shows up as a “307 Internal Redirect”, a redirect that happens entirely inside the browser.
• No unencrypted request ever leaves the device. Because the upgrade happens internally, nothing goes out over plain HTTP, so there’s nothing for anyone on the same network to read or tamper with.
• Form data stays intact. A 307 redirect keeps the original request exactly as it was, so if a form or login was being submitted, the data is carried across to the secure request unchanged.
• It renews itself. Each visit refreshes the rule. If you ever removed the header, browsers would drop the rule once the max-age ran out, which is why the browser uses a temporary (307) redirect rather than a permanent one.

Why HSTS matters for security

• It closes the HTTP gap. A normal server redirect from HTTP to HTTPS still means the first request travels unencrypted. Someone on the same public Wi-Fi could intercept it and keep the visitor on an insecure copy of the site (an attack known as SSL stripping). HSTS removes that opening for returning visitors.
• It stops visitors clicking through certificate warnings. On an HSTS site the browser won’t let people ignore an invalid certificate warning, which protects them from fake sites pretending to be yours.
• Security tools expect it. Scanners such as Qualys SSL Labs and Mozilla Observatory check for the header, and SSL Labs only gives its top A+ grade to sites that send it. Customers, payment providers and security questionnaires increasingly check these scores too.

It matters most on WooCommerce stores, membership sites and anything with a login or checkout, where customer data is being sent back and forth.

Why HSTS matters for SEO

Every page on your site can exist at two addresses, the http:// version and the https:// version. Google has to pick one as the canonical (main) version, and mixed signals can lead to the wrong one being chosen or ranking signals being split across both.

Google’s own documentation lists implementing HSTS as one of the ways to tell it you want the HTTPS version treated as canonical, alongside redirects and canonical tags. HSTS also means visitors always end up on HTTPS URLs, so the links they copy, share and link to are the secure ones.

Keep your redirects. Googlebot crawls with a clean slate and doesn’t remember HSTS rules, so it still relies on your normal 301 redirect from HTTP to HTTPS. HSTS adds to that redirect; it doesn’t replace it.

Why HSTS matters for speed

• It removes a redirect. Without HSTS, any visit that starts on an http:// link (old bookmarks, older backlinks, typed addresses) has to go to your server and back before the real page even starts loading. With HSTS the upgrade happens instantly inside the browser, which cuts Time To First Byte for those visits.
• It guarantees the fast protocols. Browsers only use HTTP/2 and HTTP/3 over HTTPS. HTTP/3 is built on QUIC, which has encryption built in. By forcing every request onto HTTPS, HSTS makes sure visitors always get these faster protocols, with multiplexed downloads and quicker connections, instead of falling back to the much older HTTP/1.1 over plain HTTP.

Before you start

Your site needs a working SSL certificate first, and it must load correctly over HTTPS. Don’t enable HSTS on a site without one, because browsers will refuse to load it over HTTP and the site will break for returning visitors. If you haven’t set up SSL yet, follow how to get and issue the free SSL certificates first.

How to enable HSTS in the WP Alpha hosting panel

1. Log in to the hosting admin panel and open your site’s dashboard.
2. Click SSL/TLS Certificates. This is the SSL certificate area for the site.
3. If you’ve only just added the site, it may not have a certificate yet. In that case the button reads Issue certificate rather than Reissue. Issue the certificate and wait until it’s in place before going further.
4. Click the HSTS option.
5. Set the max age to at least 6 months.
6. Leave the option to include subdomains off. You may want it depending on your setup (for example if every subdomain also has a valid certificate), but by default it should stay off.
7. Click Enable HSTS. This adds the header to your site, telling browsers they can only access it in secure mode.

Using Cloudflare? It still works

The HSTS setting in the hosting panel works even if your site runs through Cloudflare. Cloudflare passes the header from our servers straight through to your visitors, so you don’t need to change anything in Cloudflare for it to take effect. We checked this on Cloudflare-proxied sites on our platform, and every one delivered the header to visitors.

Cloudflare also has its own HSTS setting (under SSL/TLS, Edge Certificates). You can use either one. If you switch on both, Cloudflare’s values replace ours, so pick one place to manage it to avoid confusion.

Testing it

Search for “HSTS tester” and use one of the free online tools, or run your site through an SSL test such as Qualys SSL Labs. Enter your web address and run the test. A successful result reports that a Strict-Transport-Security header was found, and your SSL grade should go up.

If your site redirects the bare domain to www (or the other way round), test the address your visitors actually end up on.

Common problems

• The tester doesn’t find the header: check you clicked Enable HSTS on the right site, then test the final address your site redirects to.
• The site won’t load after enabling HSTS: check that the SSL certificate was issued and is in place, then contact support.
• A subdomain stopped loading: if you turned on the include subdomains option, every subdomain needs a valid certificate. Turn the option off, or add certificates to those subdomains.
• Should I submit my site to the HSTS preload list? Only once HSTS has run without problems for a while and every subdomain is on HTTPS. Getting removed from the preload list takes months, so it’s not something to do on day one.

If you get stuck or aren’t sure about any of this, our support team can help via a ticket from the client area or live chat.