Category: WordPress Security
Common issues with HSTS
There are several causes for HTTP Strict Transport Security (HSTS) not working correctly. The most common HSTS issues are listed in this article. Response error: Multiple HSTS headers (number of HSTS headers: 2) When you see this error the HSTS header has been set twice. The HSTS header should be set only once. This is usually caused by a second HSTS header, added by either your hosting provider or a different plugin. This header is often located in the .htaccess file. Check your
Getting everything out of your security headers
After you enable Really Simple Security (Pro), there will be quite a number of new features available to you. We recommend to start by navigating to Security -> Settings, and work your way down through the available options to enable all of the desired security settings. This includes all of the recommended Security Headers as well. We sometimes get the question: “Which headers should I enable, and why aren’t they all just enabled by default?”. This is not always possible,
How to use the Content Security Policy generator
Really Simple Security (Pro) has the ability to generate a Content Security Policy for your WordPress site. A Content Security Policy is an added layer of security that can mitigate and detect various security threats. Since this is an advanced feature, we recommend using this function if you have an understanding of what a Content Security Policy does. Do note that the Content Security Policy does not offer 100% protection to your site, as both script-src and style-src need to
Inserting HSTS header using PHP
HSTS Header insertion Really Simple Security Pro has the ability to set the HSTS header for your website. From version 6 and upwards this is performed via PHP, so there is no need to edit server config files like htaccess or nginx.conf anymore.