🔒 WordPress Security Headers – A Simple Guide to Making Your Website Safer

Security headers are an essential layer of defence against attacks like **cross-site scripting (XSS), clickjacking, and code injection**. In this guide, we’ll cover how to implement important security headers on your WordPress website.

📌 What Are Security Headers?

Security headers instruct browsers on how to handle your website’s content securely. They protect against common cyber threats by enforcing security policies.

📌 How to Implement Security Headers in WordPress

You can add security headers using:

• Editing the .htaccess file (for Apache servers)
• Modifying the nginx.conf file (for NGINX servers)
• Using a WordPress security plugin
• Adding custom PHP functions in functions.php

📌 Important Security Headers

1️⃣ Content Security Policy (CSP)

Prevents the execution of malicious scripts by restricting the sources of content.

Header set Content-Security-Policy "default-src 'self'; script-src 'self' https://trusteddomain.com;"

2️⃣ X-Frame-Options

Prevents **clickjacking attacks** by blocking your site from being embedded in iframes.

Header always set X-Frame-Options "SAMEORIGIN"

3️⃣ X-Content-Type-Options

Stops browsers from interpreting files as something else than declared (MIME sniffing).

Header always set X-Content-Type-Options "nosniff"

4️⃣ Strict-Transport-Security (HSTS)

Forces browsers to only connect using **HTTPS**, preventing man-in-the-middle attacks.

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

5️⃣ Referrer-Policy

Controls how much referrer information is sent with requests.

Header always set Referrer-Policy "no-referrer-when-downgrade"

6️⃣ Permissions-Policy

Restricts browser features like camera, microphone, and geolocation.

Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

📌 Adding Security Headers in WordPress

✅ Method 1: Using .htaccess (Apache)

Edit your .htaccess file and add:

<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set Referrer-Policy "no-referrer-when-downgrade"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

✅ Method 2: Using Nginx

Add these lines to your nginx.conf file:

server {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
}

✅ Method 3: Using a WordPress Plugin

Install a plugin like:

• Security Headers Plugin
• HTTP Headers
• Really Simple SSL

✅ Method 4: Adding via functions.php

You can also add headers using PHP:

function add_security_headers() {
    header("Content-Security-Policy: default-src 'self'; script-src 'self'");
    header("X-Frame-Options: SAMEORIGIN");
    header("X-Content-Type-Options: nosniff");
    header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
    header("Referrer-Policy: no-referrer-when-downgrade");
    header("Permissions-Policy: geolocation=(), microphone=(), camera=()");
}
add_action('send_headers', 'add_security_headers');

📌 How to Test Security Headers

After adding the headers, test them using:

• 🔹 https://securityheaders.com/
• 🔹 Browser Developer Tools (Network → Headers)
• 🔹 curl -I https://yourwebsite.com

✅ Conclusion

Implementing security headers is an easy way to strengthen WordPress security. By adding them via .htaccess, nginx.conf, or plugins, you can reduce vulnerabilities and protect user data.

Have questions? Let me know! 🚀