Security headers are hidden instructions your site sends with each page that tell the visitor’s browser which protections to switch on. Your site sends them with every page and the visitor’s browser follows them, which makes them one of the cheapest layers of protection you can add.
What are security headers?
Security headers are HTTP headers. Examples of what they can do: allow only HTTPS, or limit which scripts may run.
Every response from your server carries HTTP headersAn HTTP header is a short line of extra information that a browser and a website send each other with every page request, invisible to the visitor., and some of them are about safety. The browser does what a header says: if you tell it to only ever use a secure connection, it will refuse to fall back to an insecure one. If you tell it which scripts are allowed, it will block the rest.
The main ones are easy to name. Strict-Transport-Security tells the browser to use HTTPS for your site, building on your TLSAn SSL/TLS certificate proves your website is really yours and scrambles the data between visitor and site. It shows as HTTPS and a padlock in the address bar. setup. Content-Security-Policy lists which sources of scripts, styles and images are allowed. X-Content-Type-Options stops the browser from guessing file types. A frame rule, either the frame-ancestors part of the policy or the older X-Frame-Options, controls who may show your page inside a frame. Referrer-Policy limits how much of your address is passed to other sites. Permissions-Policy limits browser features like the camera.
What they do and do not do
Security headers work in the visitor’s browser. They cannot fix a weakness on your server, and they do not stop an attack that never touches a browser. What they do is make a whole family of browser-side problems harder, for instance by limiting what an injected script from cross-site scriptingCross-site scripting (XSS) is an attack that sneaks a harmful script into one of your pages, so it runs in your visitors' browsers as if you had placed it. can do.
What it means for a PHP or WordPress site
Neither PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. nor WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. core sets a full set of security headers for you. They come from your web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. configuration, your host, a CDNA CDN is a network of servers around the world that keeps copies of your website close to your visitors, so pages load fast wherever they are. or a pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop.. On many sites some are missing, which is easy to spot and cheap to fix. The Content-Security-Policy is the trickiest, because WordPress themes and plugins often rely on inline scripts and outside services that the policy would block.
Headers sit next to other signals that your site sends to the outside. The X-Powered-ByX-Powered-By is a hidden label a website can send along that tells anyone who asks which software it runs, such as PHP/8.1. header, for example, reveals your PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing., while the headers above add protection.
A concrete example
You open your site’s response headers in your browser’s developer tools. You see a line “Strict-Transport-Security” and a line “X-Content-Type-Options: nosniff”, but nothing for Content-Security-Policy or Referrer-Policy. That is a normal picture. The first two are quick to add and rarely cause trouble. The policy needs more care: start in a mode that only reports what would be blocked, fix what shows up, then enforce it.
How to check and when to act
Use your browser’s developer tools to read the headers, or an online header scanner. With our free tool you can check your PHP version: it reads the public headers of your site and tells you what it can see from the outside. Start with the cheap headers, plan the strict policy and write down what you changed.
If your site mostly shows content, a site that you move from WordPress to a static site is served as files from a host or CDN where the headers are set once in one place, which makes this much easier to keep right. Whatever route you pick, headers are an extra layer, and updating the software stays the main job.
Frequently asked questions
Which security headers matter most?
A good starting set is Strict-Transport-Security (only HTTPS), Content-Security-Policy (which scripts may run), X-Content-Type-Options, a frame-ancestors rule or X-Frame-Options (who may embed your page) and Referrer-Policy.
Do security headers fix vulnerabilities?
No. They add a layer of protection in the visitor's browser and limit what a flaw can do. The flaw itself is fixed by updating the software.
Where do I set security headers?
On the web server, in the CDN or host settings, or through a plugin. Where depends on how your site is served. A host or developer can set them for you.
Can security headers break my site?
Yes, mainly a strict Content-Security-Policy, which can block scripts and styles your site needs. Test changes on a copy and roll out gradually.