HSTS is HTTP Strict Transport Security, a means to enforce using SSL even if the user accesses the site through HTTP and not HTTPS.
As of April 2026, LH HSTS is a WordPress ssl plugin with 600 active installations and a 3.9/5 rating from 7 reviews. It has been downloaded 350K+ times in total. Requires WordPress 3.0+ and PHP false+. Available on WordPress.org since 2016. Last updated 5 years ago — may have compatibility concerns. Top alternative: Cloudflare.
This plugin send the proper headers for full ssl security. For more information on what this is and why it is important visit: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
The options are preset to enable browsers to preload the HSTS directive but can be overwritten by filters which are clearly documented in the code.
Did you find this plugin helpful? Please consider writing a review.
add_filter('lh_hsts_max_age', 'modify_ls_hsts_max_age_func');
function modify_ls_hsts_max_age_func( $max_age ){
return false;
}
`
To update the subdomain settings, add the following code to your functions.php
add_filter(‘lh_hsts_subdomain’, ‘modify_ls_hsts_subdomain_func’);
function…
| WordPress | 3.0+ requiredTested up to 5.4.19 |
| PHP | false+ required |
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.