Home Admin

Embed Snippet on Your Site

<script src="https://library.wpcode.com/embedjs/d2z1g345.js/"></script>

Add Security Headers

Adds missing security headers to standard Wordpress sites:

1. Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
2. X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN".
3. X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
4. Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
5. Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.

Recommended to verify at https://securityheaders.com after installation.

Kiri Vadivelu

<10

Code Preview

Comments

php


	`<?php`
	`function add_security_headers() {`
	`header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");`
	`// header("Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; frame-ancestors 'self'");`
	`header("X-Frame-Options: SAMEORIGIN");`
	`header("X-Content-Type-Options: nosniff");`
	`header("X-XSS-Protection: 1; mode=block");`
	`header("Referrer-Policy: strict-origin-when-cross-origin");`
	`header("Permissions-Policy: camera=(), microphone=(), geolocation=()");`
	`}`
	`add_action('send_headers', 'add_security_headers');`

function add_security_headers() {
    header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
    // header("Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; script-src 'self' 			'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; frame-ancestors 'self'");
	header("X-Frame-Options: SAMEORIGIN");
    header("X-Content-Type-Options: nosniff");
    header("X-XSS-Protection: 1; mode=block");
    header("Referrer-Policy: strict-origin-when-cross-origin");
    header("Permissions-Policy: camera=(), microphone=(), geolocation=()");
}
add_action('send_headers', 'add_security_headers');

Embed Snippet on Your Site

Add Security Headers

Comments

Add a Comment Cancel Reply