Security Headers Worth Setting
The four headers that earn their place on a WordPress site, and the one that needs care.
Headers do not patch anything. They limit what a browser will do if something goes wrong, which makes them a genuine mitigation for XSS and clickjacking rather than a scanner-score exercise.
Set these
- Strict-Transport-Security — forces HTTPS for future visits. Start with a short max-age, then raise it once you are confident.
- X-Content-Type-Options: nosniff — stops the browser guessing content types, which matters when uploads are involved.
- Referrer-Policy: strict-origin-when-cross-origin — stops leaking full admin URLs, which sometimes contain identifiers, to third parties.
- X-Frame-Options: SAMEORIGIN (or a CSP
frame-ancestors) — prevents your admin being framed for clickjacking.
Content-Security-Policy: worth it, with care
A good CSP is the strongest browser-side mitigation against XSS available. It is also the header most likely to break a WordPress admin, because core and plugins use inline scripts liberally. Deploy it in report-only mode first, watch what breaks for a week, and consider applying a stricter policy to the front end than to /wp-admin/.
Where to set them
At the web server, or at your CDN. A plugin can do it, but that puts your security headers behind PHP execution and one more piece of code you have to maintain.
Check the result rather than the configuration: load your site and read the response headers. Plugins, page caches and CDNs all rewrite headers, sometimes silently.
Hardening reduces the damage. Patching removes the hole. Scan your site free to see what still needs patching.
