Security Headers

Modern browsers support security headers that tell them how to handle your content safely. Without these headers, your site is more vulnerable to cross-site scripting, clickjacking, and other attacks. This module adds the most important security headers with a few clicks.

Use Cases#

• Prevent your site from being embedded in malicious iframes (clickjacking)
• Block cross-site scripting (XSS) attacks
• Force browsers to respect your content types
• Enforce HTTPS-only connections for returning visitors
• Control what information is sent in referrer headers

How It Works#

When enabled, the module adds security headers to every HTTP response from your WordPress site. These headers instruct browsers on how to handle your content securely. You choose which headers to enable based on your needs.

Available Headers#

Settings#

Navigate to Switchboard → Security → Security Headers and toggle on the headers you want to enable.

Default headers (enabled automatically):

• X-XSS-Protection
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy

Optional headers (enable manually):

• HSTS (only if your site is fully HTTPS)
• Content-Security-Policy (test carefully first)

Header Details#

X-XSS-Protection#

X-XSS-Protection: 1; mode=block

Enables the browser’s built-in XSS filter. If an attack is detected, the page is blocked entirely rather than sanitized.

X-Frame-Options#

X-Frame-Options: SAMEORIGIN

Allows your site to be embedded only in iframes on your own domain. Blocks embedding on other sites, preventing clickjacking attacks where attackers overlay invisible iframes to trick users into clicking things.

X-Content-Type-Options#

X-Content-Type-Options: nosniff

Prevents browsers from “sniffing” content types. Without this, a browser might interpret a file as a different type than declared, which can be exploited for attacks.

Referrer-Policy#

Referrer-Policy: strict-origin-when-cross-origin

When users click links to leave your site, this controls what URL information is shared:

• Same-origin requests: full URL sent
• Cross-origin requests: only the origin (domain) is sent
• Downgrade (HTTPS to HTTP): nothing sent

HSTS (HTTP Strict Transport Security)#

Strict-Transport-Security: max-age=31536000; includeSubDomains

Tells browsers to only connect via HTTPS for the next year. Once a browser sees this header, it will refuse to connect over HTTP even if someone types http:// directly.

Content-Security-Policy (CSP)#

Content-Security-Policy: default-src 'self'

The strictest header. Only allows resources (scripts, styles, images) from your own domain. External resources like Google Fonts, analytics scripts, or CDN-hosted libraries will be blocked.

Verification#

After enabling headers, verify they’re working:

1. Open your site in Chrome or Firefox
2. Open Developer Tools (F12)
3. Go to the Network tab
4. Refresh the page
5. Click on the main document request
6. Check the Response Headers section

You should see your enabled security headers listed.

Online tools for testing:

• SecurityHeaders.com — Scans your site and grades your headers
• Mozilla Observatory — Comprehensive security scan

FAQ#