HSTS

When you think about securing your WordPress site, you probably think about strong passwords, plugins, and firewalls. But there is a hidden layer of security that operates every time a visitor loads your page: HTTP Security Headers. Most WordPress sites do not use these headers by default. This leaves them vulnerable to a wide range…

You have installed an SSL certificate. You have set up a 301 redirect to send all traffic from HTTP to HTTPS. You think you are secure. You might be wrong. There is a small window of vulnerability called the "First Visit Gap." When a user types yoursite.com into their browser (without https://), the browser first…