You can set a HSTS header in WordPress from your theme’s functions.php file as well. Send an HSTS header in WordPress functions.php Here I have multiple examples of setting up such an redirect in IIS: How to redirect HTTP to HTTPS on IIS. This can come in handy if you have very extensive rewrites set up.

Of course you are free to configure your own HTTP to HTTP redirect in IIS. The Edit Website HSTS screen allows you to set and configure settings like max-age, includeSubdomains, Preload and Redirect HTTP to HTTPS. You can find the GUI elements in the Action pane, under configure you have an option HSTS…. more details can be found in the configuration reference of HSTS Settings for a Web Site. HSTS can be enabled at site-level by configuring the attributes of the element under each element. With the release of IIS 10.0 version 1709, HSTS is now supported natively. Unfortunately only available to server administrators, but it’s there. Starting with IIS 10.0 version 1709, you now have the option to enable HSTS and HTTP to HTTPS redirection at the web site level. HTTP Strict Transport Security (HSTS) Support in IIS 10.0 Version 1709 You’ll find more information about this in OWASP’s HSTS HTTP Strict Transport Security examples. If you include the preload flag, your site is eligible to be included in Chrome’s HSTS preload list (also used by Firefox and Safari). Basically, all you need to add to your web.config for HSTS configuration, is an Outbound Rule, to rewrite request responses and sending the HTTP Strict Transport Security response header: Read the blog post: How to enable HTTP Strict Transport Security (HSTS) in IIS7+. Therefore, adding a HSTS header is important after you’ve added SSL to your WordPress website, so browsers automatically request your HTTPS address. HSTS Policy specifies a period of time during which the user agent should only access the server in a secure fashion. The HSTS Policy is communicated by the server to the user agent via an HTTP response header field named Strict-Transport-Security. HSTS is an IETF standards track protocol and is specified in RFC 6797. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol. HSTS improves security and prevents man-in-the-middle attacks, downgrade attacks, and cookie-hijacking. HTTP Strict Transport Security (HSTS) is a web security policy mechanism which is necessary to protect secure HTTPS websites against downgrade attacks, and which greatly simplifies protection against cookie hijacking. IIS 8.5 is the IIS version used in Windows Server 2012 R2, IIS 10.0 in Windows Server 2016 and up. 2.4 Content-Security-Policy Enable and serve an HTTP Strict Transport Security (HSTS) response header in IIS 10.0 and 8.5

Preload enabled setting in iis