WordPress security headers, CSP and HSTS without the guesswork

What WordPress security headers are

A header is a short line of text your server sends before each page. Visitors never see it, but their browser follows it. Security headers use that channel to say things like do not show this site inside another site's frame, do not guess file types, or only load scripts from these places.

Security scanners, insurers and audits often check for them first, and they close whole families of browser attacks such as clickjacking. WordPress does not send most of them by default.

The WordPress security headers Stack Guard sends

Switch on HTTP Security Headers in Core headers on the Headers tab. That one switch controls the rest: Content Security Policy, HSTS and the cross-origin headers are only sent while it is on. Headers are sent on front-end pages. The admin area, sign-in page, AJAX and REST responses do not pass through it.

• X-Frame-Options (SAMEORIGIN by default): stops other sites framing your pages, the trick behind clickjacking. Free.
• X-Content-Type-Options: tells the browser to trust the file type your server states, so an uploaded file cannot pretend to be a script. Free.
• Referrer-Policy (strict-origin-when-cross-origin by default): controls how much of your page address is passed on when a visitor clicks away. Free.
• Permissions-Policy: tells the browser your pages never use the camera, microphone, location, payment, USB or motion sensors. Free, optional.
• Cross-domain policy files blocked. Free.
• Content Security Policy builder, HSTS, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy. Pro.

Build a Content Security Policy without breaking your site

A Content Security Policy is an allow list for your pages: for each kind of content, you list where it may come from. A good one stops the browser running a script an attacker injected, which is how sign-in cookies get stolen. A policy that is too strict can also break maps, chat widgets or payment forms, so the safe path is report-only first.

• Pick a Quick preset close to your site, such as WordPress Compatible or WooCommerce. A preset replaces the directives below it.
• Set the mode to Report-only and switch on Collect violation reports. Visitors see no change.
• Browse your site for a few days, including forms, checkout and embedded video, then read the violation log and add the sources you trust.
• When the log stays quiet, switch the mode to Enforce.
• Use nonces for scripts adds a one-time code to scripts WordPress loads properly. Scripts printed straight into a page by a theme or plugin without it will be blocked.

HSTS, cross-origin headers and checking your result

HSTS makes a browser remember to use https only, which removes the first insecure request on public Wi-Fi. It is hard to undo, because browsers keep the rule until the max age runs out, so start with a short max age such as a day or a week and raise it to a year once nothing breaks. Only switch on Include subdomains and Preload when every subdomain has a working certificate. Preload submission is done by you at hstspreload.org. HSTS is only sent on requests that are already https.

Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy keep your pages and files separate from other sites. Payment and social sign-in popups can break with the stricter same-origin opener setting, so test checkout and sign-in after changing them.

After you save, use the scan link in the Response headers panel to check the result from outside. Your host, a CDN or another plugin may send some of the same headers, and two copies can confuse browsers, so switch duplicates off in one place. Stack Guard's compatibility check reads what your host or CDN already sends.