Hi @pokongku,
I am Andrea, I will help you in your thread as soon as possible.
I’m going to ask you for some more information:
1) In Settings > click Headers Security Advanced & HSTS WP > it will show you the section with the HSTS WP feature you have to check the inherent values if not active and save.
2) If instead option 1 has already been executed I ask you plugin version instalalto and if it shows you in the logs errors related only to the plugin.
I will be here to help you
I went to Settings, clicked Header Security Advanced & HSTS WP. I’d like to send you the screenshot but I can’t find the Attach button. Here is what I’ve got. At the very top, there were three buttons, Quick Selection: Strict Transport Security HSTS, CSP, Permission Policy. Then there are 4 check boxes, Disable (Strict Transport Security), Disable (Permissions-Policy), Disable (X-Content-Type-Options), Disable (X-Frame-Opti0ns). These boxes were all checked. Max Age is set at 6307200, then there are check boxes for Enable Include Subdomains, Enable preload, these are left unchecked. And then there are the CSP Header Contents in the box next to it says upgrade insecure requests:, CSP Report URI in the box is Enter custom url CSP, Permissions Policy Contents, in the box is accelerometer=0, camera=0, etc…. , then lastly X-Frame Options, in the box is SAMEORIGIN. I cannot see the HSTS WP feature I have to check inherent values. And I cannot find Option 1.
Hello @pokongku
I had the same issue. Could you please test your website at SSL LABS and bring to us the HSTS Header information?
https://www.ssllabs.com/ssltest/
Yeah, Pokongku, yours says “Strict Transport Security (HSTS) = NO“.
Via CPanel, open the “File Manager“, and at the public_html folder, open the hidden file “.htaccess“
Check if you can find a module like the example above:
A word of attention: Your values could be different from mine.
<IfModule mod_headers.c>
Header set Access-Control-Allow-Methods "GET,POST"
Header set Access-Control-Allow-Headers "Content-Type, Authorization"
Header set Content-Security-Policy "upgrade-insecure-requests;"
Header set Cross-Origin-Embedder-Policy "unsafe-none"
Header set Cross-Origin-Opener-Policy "unsafe-none"
Header set Cross-Origin-Resource-Policy "cross-origin"
Header set Permissions-Policy "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=*, publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=*, gamepad=(), serial=()" Header set Referrer-Policy "strict-origin-when-cross-origin"
#The max-age of 86400 seconds has been set for testing purpose, before applying 6 months or 1 year in seconds.
Header set Strict-Transport-Security "max-age=86400; includeSubDomains"
Header set X-Content-Type-Options "nosniff" Header set X-Frame-Options "SAMEORIGIN"
Header set X-Permitted-Cross-Domain-Policies "none" </IfModule>
If you can’t find the module, it’s means that OR you did not apply / save the settings OR the .htaccess has a write protection.
I cannot find Header set.
hi @pokongku,
could you tell me if you see a comment like this in the .htaccess file: Headers Security Advanced & HSTS WP -, if you see this comment do you see a Header header always set Strict-Transport-Security?
In the .htaccess file, there is no line starting with Headers…… I can send you the screenshot of the .htaccess file to your email if you like.
hi @pokongku,
si così posso velocizzare l’assistenza perché non sto ricevendo le notifiche ai thread.
support[at]tentacleplugins.com
What is your email address? qual è il tuo indirizzo email?
.htaccess file folder sent to support@tentacleplugins.com
hi @pokongku,
Thanks for the feedback I’ll check the e-mail and I’ll answer you by tomorrow morning Italian hours
Hi @pokongku,
I checked your email, thank you for the link but I can’t access the .htaccess file directly via url. Your provider blocks this for security. You can send me just one photo
Really Simple SSL is the security plugin I used for my site. Is it causing problem? It’s been telling me I have no HSTS Header from the beginning.
Hi Andrea,
I sent you an email asking for help on a certain issue.
The problem is now resolved by other means. Please take me out of the monthly coffee donation program. I can no longer afford it. Thank you. Po Ku
