When to use this guide
Use this guide when securityheaders.com (listed in the Domain & server security checklist ) shows a grade of D or lower, or flags any of the following as missing:
Strict-Transport-SecurityContent-Security-PolicyX-Content-Type-OptionsReferrer-PolicyPermissions-Policy
How urgent is this? HTTP security headers are medium-low priority. Missing headers leave the site more vulnerable to attacks like clickjacking and cross-site scripting (XSS), but they do not directly expose user data. They are quick wins and good practice, especially for sites handling donations or financial transactions.
Who does this?
The person responsible for the organisation's WordPress website. This does not require server-level access — all headers can be set via a WordPress plugin or the
.htaccess file.Background: what do security headers do?
| Header | What it does |
|---|---|
| Strict-Transport-Security | Forces browsers to always use HTTPS, even if someone types http:// |
| Content-Security-Policy | Prevents the browser from loading malicious scripts or assets |
| X-Content-Type-Options | Prevents browsers from guessing file types, reducing injection risks |
| Referrer-Policy | Controls how much referrer information is sent when navigating away from your site |
| Permissions-Policy | Controls which browser features (camera, microphone, geolocation) the site can use |
Step 1: Install a security headers plugin
Install one of the following WordPress plugins — they allow you to add security headers without touching server configuration:
- HTTP Headers by Fer Perez — most focused option, maps directly to the headers listed above
- Solid Security (formerly iThemes Security) — broader security plugin with header support
- Rank Math SEO — if already installed, has security headers built in
The most focused option is HTTP Headers by Fer Perez.
Step 2: Add the headers
After installing the plugin, add the following headers one by one:
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy
geolocation=(), microphone=(), camera=()
Skip Content-Security-Policy (CSP) for now. CSP is the most complex header and requires careful tuning per site. A wrong value can break the site — blocking legitimate scripts, fonts, or payment widgets. Tackle this separately once the other headers are in place.
Step 3: Verify
Re-run the scan at securityheaders.com . The four headers should now show green and the overall grade should improve to at least B.
If any header is still missing, double-check that the plugin is active and that there is no caching layer (e.g. Cloudflare, WP Rocket) serving a cached version of the page without the new headers. Clear all caches and re-test.