WPCheck a site
Menu

Add security headers

A few response headers tell browsers how to protect your visitors. Most hosts let you add them without touching your pages.

Steps

About an hour

All guides

  1. Report-Only
  2. Content-Security-Policy
  1. Find where your host or CDN sets response headers, or add them in your server settings.
  2. Start with the low-risk ones: X-Content-Type-Options set to nosniff, and X-Frame-Options or frame-ancestors. Add Strict-Transport-Security only once HTTPS works everywhere.
  3. Add a Content Security Policy in Report-Only mode first, so it shows what it would block without breaking anything.
  4. When the reports are clean, enforce it, then test your forms, payments and embeds.
Example
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Content-Security-Policy-Report-Only: default-src 'self'
Read the guidePublish a sitemap and robots.txt