When a browser loads your site, your server can send a set of HTTP response headers that tell the browser how to behave more safely. They cost nothing, they don't change how your site looks, and they close off some of the most common ways a site gets attacked. Yet most sites — WordPress included — ship with almost none of them, because the CMS doesn't add them: they come from your web server or a security plugin.
Here is what the important ones do.
The headers that matter
Strict-Transport-Security (HSTS)
Forces browsers to always use HTTPS for your domain, even if someone types http:// or clicks an old link. This prevents downgrade attacks and stops session cookies from ever travelling in the clear. Once set, browsers remember it for the duration you specify.
Content-Security-Policy (CSP)
The most powerful — and most involved — header. It tells the browser exactly which sources scripts, styles, images and other resources may load from. A good CSP is the strongest single defence against cross-site scripting (XSS), because injected scripts simply won't run. It takes care to get right (every legitimate inline script and third-party tool has to be allowed), which is why many sites skip it.
X-Frame-Options
Stops other sites from embedding yours inside a hidden frame — the trick behind clickjacking, where a victim thinks they're clicking your real button but are actually clicking something on an attacker's overlay.
X-Content-Type-Options
Set to nosniff, it stops the browser from guessing (MIME-sniffing) a file's type. That guessing can turn a harmless upload into an executable script; disabling it removes a whole class of attacks.
Referrer-Policy
Controls how much of your address is shared when a visitor clicks a link to another site. It keeps private paths and query strings from leaking into other companies' analytics.
Permissions-Policy
Lets you switch off browser features your site doesn't use — camera, microphone, geolocation, and so on — so a compromised script can't quietly turn them on.
How to add them
Security headers are set at the edge, not in your content:
- Nginx / Apache: add them to the server or virtual-host config (for example an
add_headerblock in Nginx). This is the most reliable place. - WordPress: a security plugin (or your host's panel) can add them without touching server files. Start with HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy — they're safe on almost any site. Add Permissions-Policy next, and CSP last, testing carefully.
Add them one at a time and re-check after each — a too-strict CSP can block your own scripts, so it's the one to introduce last.
Check your site in seconds
Not sure which headers your site sends today? Our free security headers checker grades any site from the outside — no account needed — and tells you exactly which ones are present, weak or missing.
