Add param to disable HSTS, set headers to prevent caching

1 files changed, 13 insertions, 0 deletions

diff --git a/index.php b/index.php
index 5fff7e5e..20049335 100644
--- a/index.php
+++ b/index.php
@@ -114,6 +114,19 @@ if (defined('CONFIG_DEBUG') && CONFIG_DEBUG) {
 	});
 }
 
+// Set HSTS Header if client is using HTTPS
+if(!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
+	if (Request::any('hsts') === 'off') {
+		Header('Strict-Transport-Security: max-age=0', true);
+	} else {
+		Header('Strict-Transport-Security: max-age=15768000', true);
+	}
+}
+Header('Expires: Wed, 29 Mar 2007 09:56:28 GMT');
+Header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
+Header("Cache-Control: post-check=0, pre-check=0", false);
+Header("Pragma: no-cache");
+
 // Now determine which module to run
 Page::init();