Ticket #28520: 28520.dff

Index: src/wp-includes/functions.php
===================================================================
--- src/wp-includes/functions.php       (revision 28749)
+++ src/wp-includes/functions.php       (working copy)
@@ -1018,6 +1018,43 @@
 }
 
 /**
+ * Get the headers for HSTS.
+ *
+ * This function depends on the constant, ENABLE_HSTS, to be set to the value of
+ * max-age component of the header. Setting to true will set the HSTS value for
+ * 1 year. Setting as integer will set to that value. If set to 0, it will turn
+ * off HSTS.
+ *
+ * @since 4.0.0
+ * @return array The associative array of header information to enforce HSTS.
+ */
+function get_hsts_headers() {
+       $headers = array();
+
+       if ( defined( 'ENABLE_HSTS' ) && ( is_int( ENABLE_HSTS ) || true === ENABLE_HSTS ) ) {
+               $max_age = ( true === ENABLE_HSTS ) ? 31536000 : absint( ENABLE_HSTS );
+               $headers = array(
+                       'Strict-Transport-Security' => 'max-age=' . $max_age,
+               );
+       }
+
+       return apply_filters( 'hsts_headers', $headers );
+}
+
+/**
+ * Set HSTS headers.
+ *
+ * @since 4.0.0
+ */
+function hsts_headers() {
+       $headers = get_hsts_headers();
+
+       foreach ( $headers as $header => $value ) {
+               header( $header . ': ' . $value );
+       }
+}
+
+/**
  * Set the headers for caching for 10 days with JavaScript content type.
  *
  * @since 2.1.0