Site-health problem after update

Hi @artynytsuoli,

These are recommended security headers which optimize your site security.

For example, HSTS makes sure someone else can’t fake your domain (which can be done on a WiFi network), because the site is always loaded over https, even when a user hasn’t visited the site before.

For more information please read this article
https://really-simple-ssl.com/site-health-recommended-security-headers/

Hi @rogierlankhorst
I added your rules to htacccess https://really-simple-ssl.com/site-health-recommended-security-headers/ and the site health still reports an alert.

# Really Simple SSL
Header always set Strict-Transport-Security: “max-age=31536000” env=HTTPS
Header always set X-Content-Type-Options “nosniff”
Header always set X-XSS-Protection “1; mode=block”
Header always set Expect-CT “max-age=7776000, enforce”
Header always set Referrer-Policy: “no-referrer-when-downgrade”
# End Really Simple SSL

Please also add
Header always set Content-Security-Policy "upgrade-insecure-requests"

@rogierlankhorst
Thx, it works.

Do you add that line at the end of the code before the #