Add security headers
Sends headers that stop other sites from framing your pages, stop browsers from guessing file types, keep full page addresses private when visitors follow links, and turn off camera, microphone and location access.
<?php
// Sent with every page of the public site.
add_action(
'send_headers',
static function () {
if ( headers_sent() ) {
return;
}
header( 'X-Content-Type-Options: nosniff' );
header( 'X-Frame-Options: SAMEORIGIN' );
header( 'Referrer-Policy: strict-origin-when-cross-origin' );
header( 'Permissions-Policy: camera=(), microphone=(), geolocation=()' );
}
);
Good to know
If the site uses a map or a form that asks for the visitor’s location, remove geolocation=() from the last line. HSTS isn’t included: set it at the web server once HTTPS works everywhere.
In these packs
- Harden WordPress: Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors.