How to Add Security Headers in WordPress

Security headers protect against XSS, clickjacking and protocol downgrade attacks. Here's how to add them in WordPress.

HTTP security headers are a fast, high-impact security win. Here are the key ones and how to add them.

The headers that matter

  • `Strict-Transport-Security` (HSTS)
  • `Content-Security-Policy` (CSP)
  • `X-Frame-Options: SAMEORIGIN`
  • `X-Content-Type-Options: nosniff`
  • `Referrer-Policy`
  • `Permissions-Policy`

    • Add via Nginx

    add_header X-Frame-Options "SAMEORIGIN" always;

    add_header X-Content-Type-Options "nosniff" always;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;