# Enable HSTS in WordPress

> Add security response headers for HSTS From Litespeed docs, adding rules into htaccess for security headers & HSTS Header set Content-Security-Policy "upgrade-insecure-requests" Header set Strict-Transport-Security "max-age=31536000; includeSubDomains" Header set X-Xss-Protection "1; mode=block" Header set X-Frame-Options "SAMEORIGIN" Header set X-Content-Type-Options "nosniff"…
> URL: https://www.tring-web-design.co.uk/2025/01/enable-hsts-in-wordpress/
> Last modified: 2026-09-12T16:34:36+00:00

Add security response headers for HSTS

From [Litespeed docs](https://docs.litespeedtech.com/lsws/security-headers/#add-to-htaccess), adding rules into htaccess for security headers & HSTS

Header set Content-Security-Policy “upgrade-insecure-requests”

Header set Strict-Transport-Security “max-age=31536000; includeSubDomains”

Header set X-Xss-Protection “1; mode=block”

Header set X-Frame-Options “SAMEORIGIN”

Header set X-Content-Type-Options “nosniff”

Header set Referrer-Policy “strict-origin-when-cross-origin”

Header set Permissions-Policy “geolocation=self”