Security
Setting WordPress security headers (HSTS, CSP, X-Frame-Options)
31 March 2025 · 8 min read
HTTP security headers are a powerful but undervalued security instrument. These headers instruct the browser on how to handle your website — whether it is enforcing HTTPS, preventing clickjacking or protecting against XSS.
At WP Maintainer we install these headers as standard for all our clients. In this article we explain which headers are essential and how to configure them correctly.
What are HTTP security headers?
Security headers are instructions your server sends to the browser. They determine how the browser loads your website and which security measures are applied. They cost no performance and add no complexity for visitors.
Essential security headers
**Strict-Transport-Security (HSTS)** Forces HTTPS for a specified period. Prevents man-in-the-middle attacks and protocol downgrade attacks. Example: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
**Content-Security-Policy (CSP)** Determines which resources (scripts, styles, images) may be loaded. Prevents XSS and data injection attacks. Example: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'
**X-Frame-Options** Prevents your website from being loaded in an iframe (clickjacking protection). Example: X-Frame-Options: SAMEORIGIN
**X-Content-Type-Options** Prevents MIME-type sniffing, where the browser tries to guess file types. Example: X-Content-Type-Options: nosniff
**Referrer-Policy** Controls which referrer information is sent when clicking external links. Example: Referrer-Policy: strict-origin-when-cross-origin
**Permissions-Policy** Limits which browser features are available (camera, microphone, geolocation). Example: Permissions-Policy: camera=(), microphone=(), geolocation=()
How do you install these headers in WordPress?
**Option 1: Via .htaccess (Apache)** Add the headers to your .htaccess file with the Header directive.
**Option 2: Via hosting panel** Some hosting providers offer an interface for managing security headers.
**Option 3: Via plugin** Plugins such as HTTP Headers or Security Headers make configuration easy.
Test your configuration
Test your headers after configuration with: - securityheaders.com - Mozilla Observatory - Google's Chrome DevTools
WP Maintainer service
At WP Maintainer we configure all essential security headers as a standard part of our maintenance plan. We test and monitor the configuration continuously. More than 20 years of experience in web security guarantees an optimal configuration.