Security headers are one of the highest-leverage, lowest-effort defenses you can add to WordPress. A handful of HTTP headers instruct browsers to block whole classes of attacks — and most sites ship without them.
What Security Headers Do
When a browser loads your site, your server can send headers that tell it how to behave: which scripts to trust, whether the page can be framed, how to handle mixed content. Configured well, these headers shut down cross-site scripting, clickjacking, and data leaks at the browser level.
The Headers That Matter Most
Content Security Policy
CSP is the most powerful header. It defines exactly which sources of scripts, styles, and images the browser may load, neutralizing most cross-site scripting attacks. It’s also the trickiest to configure, so start in report-only mode and tighten gradually as you confirm nothing breaks.
Strict-Transport-Security
HSTS forces browsers to use HTTPS for your site, preventing downgrade attacks and protecting against intercepted traffic. Once your SSL is solid, enable it so visitors are never served over insecure connections.
X-Frame-Options
This header stops other sites from embedding yours in a frame, defeating clickjacking attacks where a malicious page tricks users into clicking hidden elements.
Supporting Headers
- X-Content-Type-Options — stops browsers from guessing file types, blocking a class of injection tricks.
- Referrer-Policy — controls how much referrer data leaks to other sites.
- Permissions-Policy — restricts access to features like camera, microphone, and geolocation.
Adding Headers in WordPress
You can set headers at the server level in your web server config, which is the cleanest approach, or through WordPress itself if you don’t control the server. Server-level configuration applies to every request efficiently, while a plugin or theme hook works when you only have application access. Either way, apply them site-wide.
Test Before You Trust
A misconfigured CSP can break your site by blocking legitimate scripts. Always test thoroughly: use report-only mode, watch the browser console for blocked resources, and verify functionality across pages. Free online scanners will grade your headers and flag gaps.
Final Thoughts
Security headers give you outsized protection for minimal effort. Start with HSTS and X-Frame-Options for quick wins, then invest the time to build a solid Content Security Policy. Test carefully, roll out site-wide, and you’ll close off entire categories of attack with a few lines of configuration.
Key Takeaways
- Focus on fundamentals over trends — consistency beats novelty.
- Measure before and after every change so you know what worked.
- Make focused, one-at-a-time improvements you can verify and reverse.
- Turn your process into a repeatable checklist for every project.
Frequently Asked Questions
Which security header should I add first?
Start with Strict-Transport-Security and X-Frame-Options for quick, low-risk wins, then invest time in a solid Content Security Policy.
Why is Content Security Policy tricky?
Because a strict policy can block legitimate scripts and break your site. Start in report-only mode and tighten it gradually while watching for blocked resources.
Where should I set security headers?
At the web server level when you control it — it’s efficient and applies to every request. Otherwise set them through WordPress with an application-level hook.