How To Add Http Security Headers In Wordpress

Configuring recommended security headers for WordPress adds to your site'due south security. Today we are going to discuss everything nearly security headers for WordPress. And why you should be concerned with it. Typically, an HTTP security header renders boosted information (such as content type, content meta, enshroud status, etc.) attached with a spider web page, whenever a browser requests the page from the server. There are several types of HTTP headers. The ane I just talked well-nigh is called "HTTP Response Header".

The following moving-picture show will aid you understand better how HTTP headers work.

Recommended Security headers in WordPress — An case of an HTTP Response Header

Conclusively, whenever an HTTP asking is made, the result comprises two parts:

Request bulletin header
Asking message trunk

The request message headers are further divided into four header categories. Which nosotros are going to larn today. We will so be taking on the subject of recommended security headers for WordPress that yous must not skip.

Besides mentioned are the methods to check if your server has these headers.

Security headers are basically headers that protect the requested & the requesting browser from executing malicious lawmaking. That is, information technology protects both, y'all and your site's user in case the web app is injected with malicious lawmaking on the folio.

In WordPress Security headers are served directly by the web server i.e. Apache, Microsoft IIS, etc. So, for case, accept a scenario where a page has been injected with malicious iframe. Now, when the server serves that malicious web page to a user, it serves it along with some security headers. If the right kind of security headers are present (X-Frame-Options), they will stop the user'due south browser from showing that malicious iframe.

one. Cheque with Chrome DevTools

To cheque if your recommended security headers for WordPress are present, Google Chrome's dev tools can be used. To do so, implement the following steps:

#1: Right-click on the web folio and select the Inspect option.

#two: Click on the Network panel and reload the page by pressing Ctrl+R.

#3: And then, finally in the response header see what all recommended security headers for WordPress are available.

The same can exist washed using other browsers likewise.

2. Bank check with Astra's Security Scanner

If you wish to avert manually inspecting security headers, there is a way to automate the process. So, to automatically scan your website for recommended security headers in WordPress, apply the free tool provided by Astra. To practice so, implement the following steps:

#1: Visit this link and enter your domain name in the Scan choice.

#two: At present when prompted, select the Run Security Audit option.

#three: Look for the scan to finish and then click on View Results.

#4: The final results volition show all the recommended WordPress security headers that your website is missing.

Forth with checking security headers, this tool can perform 40+ other security tests also. These tests include:

Google Safety Browsing
Content Security Policy
Header Security
Cookie Security
CORS Tests
HTTPS Security

You can also apply this tool to scan your site for Malware and SEO spam.

Like we said, using the recommended security headers in your WordPress adds a layer of security to your website. Let'southward empathise how:

They tin act as the first layer of security for your website.
Protects the users of your website from malicious attacks like XSS, Clickjacking, etc even if the website has been compromised.
The HSTS security header can also assist with the website SEO.
This is a security practice that is easy to implement.
Implementing Security headers does not require additional changes in your website lawmaking.

How to add Recommended Security Headers in WordPress and their Types

Some major recommended security headers for WordPress are as follows:

ane. HTTP Strict Ship Security (HSTS)

This security header ensures that all the information is exchanged only using the HTTPS protocol. It works by directing the browsers to communicate over HTTPS instead of HTTP.

Furthermore, to implement this recommended security header in WordPress site, follow these steps:

For Nginx: Open the Nginx.conf file. Add together the post-obit lawmaking to it and save:

          add_header Strict-Ship-Security max-historic period=31536000;

For Apache: Open the .htaccess file. Add the following code to it and save:

          <VirtualHost 192.168.1.i:443> Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" </VirtualHost>

2. X-Frame-Options

Clickjacking is a type of malicious attack where the user is tricked into clicking on a transparent iframe that then leads to certain actions on the site. The X-frame security header, therefore, works by blocking that transparent iframe.

Add this recommended security header in your WordPress site as follows:

For Nginx: Open up the Nginx.conf file. Add together the following code to it and salve:

          add_header 10-Frame-Options "SAMEORIGIN" e'er;

For Apache: Open up the .htaccess file. Add the following code to it and save:

          <IfModule mod_headers.c> 	Header always append 10-Frame-Options SAMEORIGIN </IfModule>

Unable to figure out the correct recommended security headers for WordPress? Secure your WordPress site at present!

three. 10-XSS-Protection

Cantankerous-site scripting is an attack in which an attacker tricks yous into executing some malicious javascript code in your browser. This is one of the recommended WordPress security headers that work past blocking the malicious code from stealing your session cookie. It uses various filters to determine if the code is malicious.

Y'all can add X-XSS protection in your WordPress site by post-obit these steps:

For Nginx: Open the Nginx.conf file. Add the following code to it and salvage:

          add_header X-Xss-Protection "1; mode=block" always;

For Apache: Open the .htaccess file. Add together the following code to information technology and save:

          <IfModule mod_headers.c> 	Header set X-XSS-Protection "i; manner=block" </IfModule>

4. X-Content-Type-Options

Often, it is quite possible that the attacker may accept uploaded a text file with a malicious HTML lawmaking. Information technology may seem like a harmless text file but your browser will automatically detect it as HTML and run the code. This security header, therefore, works by stopping your browser from interpreting the file anything other than the declared content type.

To add this recommended security header in WordPress site, do as follows:

For Nginx: Open the Nginx.conf file. Add the post-obit lawmaking to it and salvage:

          add_header 10-Content-Type-Options "nosniff" always;

For Apache: Open the .htaccess file. Add the post-obit code to it and save:

          <IfModule mod_headers.c> 	Header set X-Content-Type-Options nosniff </IfModule>

5. Referrer-Policy

A Referrer header contains the info regarding the previous web pages visited by a user navigate to the current link. This tin be misused by an attacker or third party to track the user. To protect the privacy of users, this is 1 of the recommended WordPress Security headers that can come in handy.

Add this recommended security header in WordPress site as:

For Nginx: Open up the Nginx.conf file. Add together the post-obit code to it and save:

          add_header Referrer-Policy "no-referrer";

For Apache: Open the .htaccess file. Add together the following code to it and save:

<IfModule headers_module>         RequestHeader set X-HTTPS 1          Header set Referrer-Policy "no-referrer-when-downgrade"          </IfModule>

6. Content Security Policy

Content security policy security header basically tells your browser to run the resource only from specific domains. It is a practiced exercise to implement one of these recommended security headers in WordPress as it tin can block the execution of malicious code from other domains.

Optimize your site for content security policy past post-obit this:

For Nginx: Open the Nginx.conf file. Add the following code to it and salvage:

          add_header Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; way-src 'cocky';";

For Apache: Open the .htaccess file. Add the following code to it and save:

          Header ready Content-Security-Policy default-src 'none'; script-src 'cocky'; connect-src 'cocky'; img-src 'self'; mode-src 'self';

Moreover, if you wish to allow other domains like Google Analytics to run javascript on your site, add the URL afterwards the self option in the following fashion:

          script-src 'cocky' 'https://world wide web.google-analytics.com'

To Conclude…

Missing security headers is a major security flaw. Scan your website right now to check for the missing headers. Given the benefits attached to implementing security headers on your website, it needs no more convincing. The commodity mentions only the nearly crucial security headers, it in no way implies in that location aren't more than. There are other security headers like – Feature Policy, Expect-CT, etc yous tin can configure every bit per your needs.

Have whatever questions to ask about security headers? Comment below and someone from our team will become in touch.

Liked this blog? Subscribe & get notified whenever we post side by side.