Control HSTS IncludeSubDomains and Preload with the WP Cloud API

Why HSTS matters

Enabled by default on WP Cloud, HTTP Strict Transport Security (HSTS) can instruct browsers to load a domain over HTTPS.

Adding the includeSubDomains and preload directives:

• protects subdomains, and
• lets major browsers learn a domain’s HTTPS‑only policy in advance via preload lists—so visitors arrive securely even on the very first request.

What’s new

While strict-transport-security is enabled on all domains using WP Cloud by default, the WP Cloud Atomic API recently added two endpoints to independently control the includeSubDomains and preload HSTS directives.

ssl-hsts-subdomain

POST /ssl-hsts-subdomain/:domain/:enable

• Enables (true) or disables (false) includeSubDomains.
• When :enable is true, the call also sets preload.

ssl-hsts-preload

POST /ssl-hsts-preload/:domain/false

• Disables preload only. Browsers require includeSubDomains for preload, so enabling preload separately is not supported.
• To re-enable preload on a domain with includeSubDomains active, client hosts may call ssl-hsts-subdomain/:domain/true again. This will retain includeSubDomains and set the preload directive.

Try it today

All WP Cloud hosts can call these endpoints now. For implementation details, refer to the API documentation.