How to Fix Security Headers in WordPress: A Step-by-Step Guide

Securing your WordPress website is crucial to protect it from cyber threats. One effective way to enhance security is by properly configuring security headers. In this guide, we’ll discuss what security headers are, why they are important, and how to fix them in your WordPress site.

What Are Security Headers?

Security headers are HTTP response headers that help protect your website by instructing the browser on how to handle its content. They act as a defense layer against vulnerabilities like Cross-Site Scripting (XSS), clickjacking, and data injection. Please check yourself about your website on Securityheaders.

Refer to the below snapshot for www.mubinsmanual.com before and after fixing Security Headers.

Common Security Headers and Their Importance

Content Security Policy (CSP)
- Prevents malicious scripts from executing on your site.
- Example: Restrict loading content from unauthorized sources.
X-Content-Type-Options
- Stops browsers from interpreting files as a different MIME type than specified.
X-Frame-Options
- Protects against clickjacking attacks by controlling the ability to embed your site in iframes.
Strict-Transport-Security (HSTS)
- Forces browsers to use HTTPS, ensuring secure communication.
Referrer-Policy
- Controls what information is sent in the HTTP Referer header.
Permissions-Policy
- Limits the use of browser features like geolocation and camera access.

How to Fix Security Headers in WordPress

Step 1: Analyze Current Security Headers

Before making changes, analyze your website to identify missing or misconfigured security headers. Use tools like:

SecurityHeaders.com
Browser Developer Tools (Network > Headers)

Step 2: Backup Your Website

Always create a backup of your WordPress site before making changes. Use plugins like UpdraftPlus or BackupBuddy for this purpose.

Step 3: Add Security Headers Using a Plugin

The easiest way to fix security headers in WordPress is by using a plugin.

Install and activate the HTTP Headers plugin.
Navigate to Settings > HTTP Headers.
Configure the headers:
- Content Security Policy: default-src 'self';
- X-Content-Type-Options: nosniff
- X-Frame-Options: SAMEORIGIN
- Strict-Transport-Security: max-age=31536000; includeSubDomains
- Referrer-Policy: no-referrer-when-downgrade
- Permissions-Policy: geolocation=(self)
Save your changes and test your site.

Step 4: Add Security Headers Manually

If you prefer not to use a plugin, you can add security headers manually by editing your .htaccess file (for Apache) or nginx.conf file (for Nginx).

For Apache:

<IfModule mod_headers.c>
  Header set Content-Security-Policy "default-src 'self';"
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header set Referrer-Policy "no-referrer-when-downgrade"
  Header set Permissions-Policy "geolocation=(self)"
</IfModule>

For Nginx:

add_header Content-Security-Policy "default-src 'self';";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header Referrer-Policy "no-referrer-when-downgrade";
add_header Permissions-Policy "geolocation=(self)";

Save the changes and restart your server.

Step 5: Test and Verify Changes

Re-run the security header analysis tool to confirm that the headers are correctly applied. Check your site functionality to ensure no critical elements are broken.

Best Practices for Maintaining Security Headers

Regularly monitor your site’s security headers.
Keep WordPress core, themes, and plugins up to date.
Use an SSL certificate to enable HTTPS.
Perform periodic backups to recover quickly from issues.

Final Thoughts

Fixing security headers is a vital step in securing your WordPress website. Whether you choose to use a plugin or make manual adjustments, it’s essential to test and maintain these configurations regularly. A well-secured website not only protects your visitors but also boosts your search engine rankings by building trust and credibility.

Do you need help with WordPress security or SEO optimization? Contact us today for expert guidance!