Support » Plugin: Security Headers » Plugin doesn’t save settings!

  • Resolved digitalmnemes


    I’ve changed the settings multiple times but when I press on save, all the checkboxes are unchecked and the text boxes are empty.

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author SimonRWaters



    it looks like you have WordPress 5.2.3, I tried on recent WordPress and the plugin worked there, the plugin uses the standard approach to saving settings in WordPress and is working for me, so likely something in your environment.

    If you open up the developer tools (Ctrl + Shift + i in Chrome), pick the “Network” tab, and then load the settings page, when you save settings you should see an “options.php” request added to the network list, you should see a “302 Found” in the source view of the Response Header, and you should see your settings in parsed “Form Data” section.

    Should look something like this:

    Take a look at that, and check the “error log” from your WordPress host for entries that appear when you submit the settings you want. If it is getting something other than “302 Found” it could be a Web Application Firewall triggering, or similar.

    If you do need to share a screenshot be careful to make sure you aren’t sharing any cookie entries in the requests/response, as that could include the cookie that makes you WordPress admin (and you don’t want to share that to everyone).

    Thread Starter digitalmnemes


    Hi. I don’t know how to bring up the error log, but it seems like it’s not necessary now. it does save settings now (I haven’t done anything), but I’ve checked on this website, it says “No HSTS header” and is a subdomain. Please preload instead. But this website says I do have it…

    Is there something that the plugin doesn’t let me do to be able to be accepted for the preload list? Or are they just not detecting the headers right now? I’ve set the time to live to 31536000 seconds and checked the other 2 checkboxes.

    Plugin Author SimonRWaters


    For preload they have specific requirements for the superdomain “” as stated on thepage you linked. You may need to direct that at your WordPress instance, or other site that you control the headers for, to satisfy those conditions. It just needs a redirect to www version and have the strict transport security header with preload (so valid certificate) on the redirect.

    That said even without preload a correct Strict-Transport-Security config with long max-age is still well ahead of the bulk of websites.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Plugin doesn’t save settings!’ is closed to new replies.