title: HSTS header (through .htaccess) not being served on Wordpress pages
body: <p>My Wordpress website had HSTS headers set up through .htaccess file and it was working fine, until at some point it stopped sending the header, and I don't know when or why (I've since been configuring and updating my VPS server, so everything is possible). The thing is, it still works if I add the header directly to httpd.conf file, just not when I try to do it on site by site basis through .htaccess file. Redirects, passwords and other things still work using .htaccess btw...</p>
  <p>Furthermore, a blank test html page I created still sends the HSTS header. So what could be overwritting the HSTS rule when it comes to serving wordpress PHP pages? Because clearly the httaccess code is still correct, since html page serves it as intended.</p>
  <p>This is the code I use:</p>
  <pre><code>Header always set Strict-Transport-Security &quot;max-age=63072000; includeSubDomains; preload&quot; env=HTTPS
  </code></pre>
  <p>I repeat, this same code works if I edit the Apache config file... and it still works through .htaccess when I serve blank html files. There must be an easy explanation for this? Thanks!</p>
  <p>UPDATE on MrWhite's request. Here is the content of my .htaccess:</p>
  <pre><code>RewriteEngine On
  
  Header set Strict-Transport-Security &quot;max-age=63072000; includeSubDomains; preload&quot; env=HTTPS
  
  RewriteCond %{SERVER_PORT} !^443$
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  
  &lt;files wp-config.php&gt;
  order allow,deny
  deny from all
  &lt;/files&gt;
  
  Options -Indexes
  
  ErrorDocument 401 default
  ErrorDocument 403 Denied
  
  &lt;FilesMatch “wp-login.php”=””&gt;
  AuthType Basic
  AuthName &quot;Private area. Failed attempt IPs logged and reported.&quot;
  AuthUserFile &quot;/home/censoredusername/.htpasswds/public_html/wp-admin/passwd&quot;
  Require valid-user
  &lt;/FilesMatch&gt;
  
  &lt;Files admin-ajax.php&gt;
  Order allow,deny
  Allow from all
  Satisfy any
  &lt;/Files&gt;
  
  # BEGIN WordPress
  # The directives (lines) between &quot;BEGIN WordPress&quot; and &quot;END WordPress&quot; are
  # dynamically generated, and should only be modified via WordPress filters.
  # Any changes to the directives between these markers will be overwritten.
  &lt;IfModule mod_rewrite.c&gt;
  RewriteEngine On
  RewriteBase /
  RewriteRule ^index\.php$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
  &lt;/IfModule&gt;
  
  # END WordPress
  
  # Wordfence WAF
  &lt;Files &quot;.user.ini&quot;&gt;
  &lt;IfModule mod_authz_core.c&gt;
      Require all denied
  &lt;/IfModule&gt;
  &lt;IfModule !mod_authz_core.c&gt;
      Order deny,allow
      Deny from all
  &lt;/IfModule&gt;
  &lt;/Files&gt;
  
  # END Wordfence WAF
  </code></pre>
  <p>Here are the redirects and server responses that come with html and php outside the WordPress (without htaccess specified env var). They are missing the www redirect because that one was done by WordPress so far. Will include it in htaccess from now on.</p>
  <p>PHP:</p>
  <pre><code>censored.com/test.php
  
  HTTP/1.1 301 Moved Permanently
  Date: Thu, 03 Dec 2020 13:39:33 GMT
  Server: Apache
  X-XSS-Protection: 1; mode=block;
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Location: https://censored.com/test.php
  Content-Length: 243
  Content-Type: text/html; charset=iso-8859-1
  
  https://censored.com/test.php
  
  HTTP/1.1 200 OK
  Date: Thu, 03 Dec 2020 13:39:36 GMT
  Server: Apache
  X-XSS-Protection: 1; mode=block;
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Vary: User-Agent
  Content-Length: 11
  Content-Type: text/html; charset=UTF-8
  </code></pre>
  <p>HTML:</p>
  <pre><code>censored.com/test.html
  
  HTTP/1.1 301 Moved Permanently
  Date: Thu, 03 Dec 2020 13:42:39 GMT
  Server: Apache
  X-XSS-Protection: 1; mode=block;
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Location: https://censored.com/test.html
  Content-Length: 244
  Content-Type: text/html; charset=iso-8859-1
  
  https://censored.com/test.html
  
  HTTP/1.1 200 OK
  Date: Thu, 03 Dec 2020 13:42:41 GMT
  Server: Apache
  X-XSS-Protection: 1; mode=block;
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Last-Modified: Wed, 02 Dec 2020 12:45:56 GMT
  Accept-Ranges: bytes
  Content-Length: 120
  Vary: Accept-Encoding,User-Agent
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  Content-Type: text/html
  </code></pre>