All sites hosted by Seravo have an active HTTPS certificate and baseline HSTS (HTTP Strict Transport Security) protection enabled by default. HSTS is an HTTP response header that informs browsers that the site must only be accessed over an encrypted HTTPS connection. If the browser detects an unencrypted connection, it refuses to load the page, effectively mitigating man-in-the-middle attacks (such as DNS spoofing).
At Seravo, HSTS is pre-configured for all sites in the /data/wordpress/nginx/security.conf file with the value max-age=63072000 (meaning browsers cache this requirement for two years). This guide explains how you can tighten these rules further.
Prerequisites
SSH access to the server.
Certainty that all your subdomains (e.g., test.example.com) have an active HTTPS certificate if you plan to enable the
includeSubDomainsdirective.
Method 1: Tightening HSTS Settings in Nginx Configuration (Recommended)
If you want to enforce HTTPS encryption across all subdomains or submit your domain to the global HSTS Preload list, you can edit the nginx configuration via the command line.
Connect to the server and open the configuration file: Connect to your site via SSH and open the
security.conffile in a text editor (e.g., nano):nano /data/wordpress/nginx/security.conf
Update the HSTS header: Locate the line reading
add_header Strict-Transport-Security "max-age=63072000;";and replace it with your desired tightened version. Example of the strictest configuration:add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
Save the file: Save your changes and exit the editor.
Restart nginx: For the new configuration to take effect, restart the HTTP server by running:
wp-restart-nginx
Method 2: Sending the HSTS Header via PHP Code
Alternatively, you can send the HSTS header directly from your WordPress PHP code (for example, in your theme’s functions.php file) using WordPress's send_headers hook. In Seravo's environment, however, configuring the header at the nginx level (Method 1) is the recommended approach due to its superior performance and reliability.
Troubleshooting / Frequently Asked Questions
What risks are associated with stricter HSTS directives?
includeSubDomains: This directive enforces the HTTPS rule across all subdomains under your domain. Do not enable this if you have even a single unencrypted or non-SSL subdomain, as browsers will immediately block visitors from reaching it.preload: This parameter permits your domain to be submitted to the hardcoded HSTS preload list maintained by major browsers (such as Chrome and Firefox). If your site is added to this list and you ever need to disable HTTPS, removing your domain from the preload list can take months. During this period, the site will remain inaccessible to users over HTTP.
How can I test that my HSTS configuration works?
After restarting nginx, you can verify your HSTS header and test your domain's readiness for the preload list using the official tool at hstspreload.org.
Not sure if your site is ready for stricter HSTS settings?
You can order a site review from Seravo as expert work, where we verify your server environment and subdomains before applying stricter HSTS policies.
See Also
HSTS is an effective way to ensure that your site's web traffic remains encrypted and protected against man-in-the-middle attacks. Seravo's default configuration already provides strong baseline security for most sites, but tighter directives can elevate your site's security posture to the highest standard. If you need assistance with nginx configurations or want to confirm your site's readiness before submitting to the HSTS Preload list, our customer support and WordPress experts are always ready to help at [email protected].