{"id":1969,"date":"2026-08-17T13:46:46","date_gmt":"2026-08-17T10:46:46","guid":{"rendered":"https:\/\/allinonewpsettings.com\/blog\/?p=1969"},"modified":"2026-08-23T22:49:11","modified_gmt":"2026-08-23T22:49:11","slug":"wordpress-te-hsts-guvenli-sekilde-nasil-etkinlestirilir","status":"publish","type":"post","link":"https:\/\/allinonewpsettings.com\/blog\/tr\/wordpress-te-hsts-guvenli-sekilde-nasil-etkinlestirilir\/","title":{"rendered":"WordPress’te HSTS G\u00fcvenle Nas\u0131l Etkinle\u015ftirilir?"},"content":{"rendered":"

HSTS, taray\u0131c\u0131ya belirli bir s\u00fcre boyunca siteye yaln\u0131zca HTTPS ile ba\u011flanmas\u0131n\u0131 s\u00f6yler. Yanl\u0131\u015f yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda sunucudaki ba\u015fl\u0131\u011f\u0131 kald\u0131rmak hemen yeterli olmaz; taray\u0131c\u0131 daha \u00f6nce kaydetti\u011fi politikay\u0131 uygulamay\u0131 s\u00fcrd\u00fcr\u00fcr.<\/p>\n

Bu nedenle HSTS, HTTPS kurulumu tamamland\u0131ktan ve sertifika yenilemesi s\u0131nand\u0131ktan sonra a\u015famal\u0131 olarak a\u00e7\u0131lmal\u0131d\u0131r. includeSubDomains<\/code> ve preload se\u00e7enekleri, b\u00fct\u00fcn alt alanlar haz\u0131r olmadan kullan\u0131lmamal\u0131d\u0131r.<\/p>\n

\n

\u0130\u00e7indekiler<\/strong><\/p>\n

    \n
  1. HSTS nedir?<\/a><\/li>\n
  2. Ger\u00e7ek\u00e7i bir WordPress \u00f6rne\u011fi<\/a><\/li>\n
  3. Ne zaman kullan\u0131lmal\u0131d\u0131r?<\/a><\/li>\n
  4. G\u00fcvenli etkinle\u015ftirme ad\u0131mlar\u0131<\/a><\/li>\n
  5. \u0130leri teknik kontroller<\/a><\/li>\n
  6. Riskler ve geri alma<\/a><\/li>\n
  7. AIOWS nas\u0131l yard\u0131mc\u0131 olur?<\/a><\/li>\n
  8. \u0130lgili AIOWS yaz\u0131lar\u0131<\/a><\/li>\n
  9. Sonu\u00e7 ve \u00f6nerilen yol<\/a><\/li>\n
  10. Resm\u00ee kaynaklar<\/a><\/li>\n<\/ol>\n<\/div>\n

    HSTS nedir?<\/h2>\n

    Strict-Transport-Security<\/code> ba\u015fl\u0131\u011f\u0131, destekleyen taray\u0131c\u0131lar\u0131n belirtilen max-age<\/code> s\u00fcresince HTTP yerine HTTPS kullanmas\u0131n\u0131 sa\u011flar. includeSubDomains<\/code> politikay\u0131 alt alanlara ta\u015f\u0131r; preload<\/code> ise taray\u0131c\u0131lar\u0131n yerle\u015fik listesine kat\u0131lma niyetini belirtir. HSTS sertifika kurmaz ve bozuk HTTPS’yi d\u00fczeltmez.<\/p>\n

    Ger\u00e7ek\u00e7i bir WordPress \u00f6rne\u011fi<\/h2>\n

    Ana site HTTPS kullan\u0131yor, ancak eski bir posta veya staging alt alan\u0131 h\u00e2l\u00e2 yaln\u0131z HTTP destekliyor. K\u00f6k alan bir y\u0131ll\u0131k max-age<\/code> ve includeSubDomains<\/code> g\u00f6nderirse taray\u0131c\u0131 bu alt alanlara da HTTPS ile gitmeye zorlan\u0131r ve eri\u015fim kesilir.<\/p>\n

    Bir ba\u015fka risk, sertifika yenilemesi ba\u015far\u0131s\u0131z oldu\u011funda uzun HSTS s\u00fcresi nedeniyle ziyaret\u00e7inin HTTP \u00fczerinden ge\u00e7ici bir bak\u0131m yoluna d\u00f6nememesidir. Yenileme ve acil eri\u015fim plan\u0131 bu y\u00fczden \u00f6nceden s\u0131nanmal\u0131d\u0131r.<\/p>\n

    Ne zaman kullan\u0131lmal\u0131d\u0131r?<\/h2>\n

    HSTS ancak k\u00f6k alan, www<\/code> ve kapsanacak b\u00fct\u00fcn alt alanlar kararl\u0131 HTTPS sunuyorsa etkinle\u015ftirilmelidir. HTTP y\u00f6nlendirmesi, sertifika kapsam\u0131, otomatik yenileme ve kritik \u00fc\u00e7\u00fcnc\u00fc taraf ba\u011f\u0131ml\u0131l\u0131klar\u0131 do\u011frulanmadan uzun s\u00fcreli politika yay\u0131mlamay\u0131n.<\/p>\n

    G\u00fcvenli etkinle\u015ftirme ad\u0131mlar\u0131<\/h2>\n
      \n
    1. Herkese a\u00e7\u0131k t\u00fcm ilgili hostlar\u0131 ve alt alan adlar\u0131n\u0131 envantere al\u0131n.<\/li>\n
    2. Her hostta sertifikan\u0131n ge\u00e7erli oldu\u011funu, HTTP’den HTTPS’ye tek y\u00f6nlendirme yap\u0131ld\u0131\u011f\u0131n\u0131 ve otomatik yenilemenin \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n.<\/li>\n
    3. Ba\u015fl\u0131\u011f\u0131 yaln\u0131z bir katmanda \u00fcretin.<\/li>\n
    4. includeSubDomains<\/code> olmadan k\u0131sa bir max-age<\/code> ile ba\u015flay\u0131n.<\/li>\n
    5. Giri\u015f, form, API, callback ve indirme yollar\u0131n\u0131 temiz taray\u0131c\u0131 profiliyle s\u0131nay\u0131n.<\/li>\n
    6. Kararl\u0131 bir i\u015fletim d\u00f6neminden sonra s\u00fcreyi kademeli art\u0131r\u0131n.<\/li>\n<\/ol>\n

      \u0130leri teknik kontroller<\/h2>\n

      Ba\u015fl\u0131\u011f\u0131n yaln\u0131z HTTPS yan\u0131t\u0131nda, beklenen hostta ve tek kez g\u00f6nderildi\u011fini kontrol edin. CDN ile origin aras\u0131nda farkl\u0131 ba\u015fl\u0131klar varsa nihai ziyaret\u00e7i yan\u0131t\u0131n\u0131 esas al\u0131n. Sertifika yenilemesi, IPv4\/IPv6, farkl\u0131 edge b\u00f6lgeleri ve alt alan hizmetlerini ayr\u0131 do\u011frulay\u0131n.<\/p>\n

      includeSubDomains<\/code> i\u00e7in DNS envanterini ge\u00e7mi\u015f kay\u0131tlar ve delege edilmi\u015f alt alanlarla birlikte inceleyin. Preload ba\u015fvurusunu ayr\u0131 ve daha kal\u0131c\u0131 bir karar olarak de\u011ferlendirin.<\/p>\n

      Riskler ve geri alma<\/h2>\n

      \u0130lk g\u00fcnden uzun max-age<\/code> kullanmak, unutulan alt alanlar\u0131 kapsamak ve \u00e7ift HSTS ba\u015fl\u0131\u011f\u0131 \u00fcretmek s\u0131k hatalard\u0131r. Sorun \u00e7\u0131karsa ba\u015fl\u0131\u011f\u0131 max-age=0<\/code> ile kald\u0131rabilirsiniz; ancak taray\u0131c\u0131n\u0131n bu yan\u0131t\u0131 ge\u00e7erli HTTPS \u00fczerinden almas\u0131 gerekir. Daha \u00f6nce preload edilmi\u015f alanlarda kald\u0131rma ayr\u0131ca zaman al\u0131r.<\/p>\n

      \n

      AIOWS nas\u0131l yard\u0131mc\u0131 olur?<\/p>\n

      AIOWS SSL Y\u00f6neticisi<\/h2>\n

      HSTS’yi devreye almadan \u00f6nce AIOWS SSL Y\u00f6neticisi, WordPress adreslerinin, HTTPS y\u00f6nlendirmelerinin ve desteklenen SSL ayarlar\u0131n\u0131n tutarl\u0131l\u0131\u011f\u0131n\u0131 denetlemeye yard\u0131mc\u0131 olur.<\/p>\n

      Mod\u00fcl, alt alan envanterini veya d\u0131\u015f hizmetlerin sertifika sa\u011fl\u0131\u011f\u0131n\u0131 garanti etmez. HSTS kapsam\u0131n\u0131 belirlemeden \u00f6nce DNS, CDN ve b\u00fct\u00fcn ba\u011f\u0131ml\u0131 hostlar ayr\u0131ca do\u011frulanmal\u0131d\u0131r. Header etkinle\u015ftirildikten sonra sitenin ger\u00e7ekten kulland\u0131\u011f\u0131 URL’leri ve istek yollar\u0131n\u0131 temiz bir taray\u0131c\u0131 profiliyle test edin; k\u0131sa s\u00fcreli ilk a\u015famay\u0131 g\u00f6zlemleyin.<\/p>\n

      Sertifika, y\u00f6nlendirme veya alt alan sorunu g\u00f6r\u00fcl\u00fcrse s\u00fcreyi art\u0131rmay\u0131n. \u00d6nce HTTPS zincirini d\u00fczeltin; HSTS’yi mevcut ar\u0131zay\u0131 gizleyen bir ara\u00e7 olarak kullanmay\u0131n.<\/p>\n

      AIOWS SSL Y\u00f6neticisi’ni inceleyin<\/a>AIOWS planlar\u0131n\u0131 kar\u015f\u0131la\u015ft\u0131r\u0131n<\/a><\/p>\n<\/section>\n

      \u0130lgili AIOWS yaz\u0131lar\u0131<\/h2>\n