Plugin doesn’t save settings!

Hi,

it looks like you have WordPress 5.2.3, I tried on recent WordPress and the plugin worked there, the plugin uses the standard approach to saving settings in WordPress and is working for me, so likely something in your environment.

If you open up the developer tools (Ctrl + Shift + i in Chrome), pick the “Network” tab, and then load the settings page, when you save settings you should see an “options.php” request added to the network list, you should see a “302 Found” in the source view of the Response Header, and you should see your settings in parsed “Form Data” section.

Should look something like this:
https://waters.me/WordPress-options.png

Take a look at that, and check the “error log” from your WordPress host for entries that appear when you submit the settings you want. If it is getting something other than “302 Found” it could be a Web Application Firewall triggering, or similar.

If you do need to share a screenshot be careful to make sure you aren’t sharing any cookie entries in the requests/response, as that could include the cookie that makes you WordPress admin (and you don’t want to share that to everyone).

Hi. I don’t know how to bring up the error log, but it seems like it’s not necessary now. it does save settings now (I haven’t done anything), but I’ve checked on this website, https://hstspreload.org/?domain=www.digitalmnemes.it it says “No HSTS header” and www.digitalmnemes.it is a subdomain. Please preload digitalmnemes.it instead. But this website says I do have it… https://www.immuniweb.com.

Is there something that the plugin doesn’t let me do to be able to be accepted for the preload list? Or are they just not detecting the headers right now? I’ve set the time to live to 31536000 seconds and checked the other 2 checkboxes.

For preload they have specific requirements for the superdomain “digitalmnemes.it” as stated on thepage you linked. You may need to direct that at your WordPress instance, or other site that you control the headers for, to satisfy those conditions. It just needs a redirect to www version and have the strict transport security header with preload (so valid certificate) on the redirect.

That said even without preload a correct Strict-Transport-Security config with long max-age is still well ahead of the bulk of websites.