Security Headers
Quick Definition
Security headers are HTTP response headers that tell browsers how to handle your site content securely. They protect against clickjacking, XSS attacks, MIME sniffing, and protocol downgrade attacks — adding an extra security layer beyond SSL.
What Are Security Headers?
Security headers are special HTTP headers your server sends with every page response. They instruct the visitor's browser on how to handle your content securely — what can be loaded, where it can be embedded, and which protocols to enforce. Think of them as security rules your server sets that the browser must follow.
Without security headers, your site is vulnerable to attacks like clickjacking (embedding your site in a malicious iframe), cross-site scripting (XSS), and protocol downgrade attacks — even if you have an SSL certificate and a firewall.
The Essential Security Headers
| Header | What It Does |
|---|---|
| Strict-Transport-Security (HSTS) | Forces browsers to always use HTTPS, even if someone types http://. Prevents protocol downgrade attacks. |
| X-Frame-Options | Prevents your site from being loaded inside an iframe on another domain. Blocks clickjacking attacks. |
| X-Content-Type-Options | Stops browsers from MIME-type sniffing. Forces the browser to trust the declared content type only. |
| Content-Security-Policy (CSP) | Controls which resources can load on your pages. The most powerful security header — prevents XSS and data injection. |
| Referrer-Policy | Controls what referrer information is sent when users click links to other sites. |
| Permissions-Policy | Controls which browser features (camera, microphone, geolocation) your site can access. |
How to Add Security Headers in WordPress
- .htaccess (Apache) — Add headers directly. Example:
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set Strict-Transport-Security "max-age=31536000" - Cloudflare — Set security headers in Rules. HSTS added automatically with "Always Use HTTPS."
- Plugins — "Headers Security Advanced & HSTS WP" adds all headers through a visual interface.
- Nginx config — Add
add_headerdirectives in your server block.
How to Test Your Security Headers
Visit securityheaders.com and enter your domain. Most WordPress sites without configuration score D or F. Adding the essential headers typically brings you to A or A+.
Why It Matters
Security headers are one of the most overlooked security measures on WordPress sites. They cost nothing, require no ongoing maintenance, and protect against entire categories of attacks that SSL and firewalls do not cover. If your site handles any user data — login forms, contact forms, payment information — security headers are not optional.
Sources: Patchstack, WPBeginner, MDN Web Docs