I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so:
The site will redirect any http:// request to https:// and I realise that this will likely result in the HSTS header being sent over http:// which it shouldn't. However, to be HSTS compliant a user agent should disregard HSTS policy delivered via http:// as it could have been maliciously injected. As this is only for testing purposes I'm not overly concerned anyway.
This will allow me to issue the header on a specific page only and expose it only to myself without affecting any other users. I could also have another page to disable the HSTS policy like so:
Should this prove to be successful are there any issues that can be seen with issuing HSTS policy in such a way? Perhaps users on shared hosting or without access/knowledge to configure a response header could still implement HSTS in this way.