Wordpress headers security

PHOTO EMBED

Mon Aug 25 2025 08:00:28 GMT+0000 (Coordinated Universal Time)

Saved by @andersdeleuran #php #wordpress #htaccess #security

<ifModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options nosniff
Header set X-Frame-Options SAMEORIGIN
Header set Referrer-Policy: no-referrer-when-downgrade
</ifModule>
content_copyCOPY

Place in .htaccess on website, to add additional security (header based) on the website. HTTP Strict Transport Security (HSTS) tells web browsers that your website uses HTTPS and should not be loaded using an insecure protocol like HTTP. X-XSS Protection allows you to block cross-site scripting from loading. X-Frame-Options prevents cross-domain iframes or click-jacking. X-Content-Type-Options X-Content-Type-Options blocks content mime-type sniffing.
https://www.wpbeginner.com/beginners-guide/how-to-add-http-security-headers-in-wordpress/#securityheaders-htaccess