Introduction
HTTP security headers are configured at the server level—outside the scope of your theme—to protect against XSS, clickjacking, MIME-type sniffing, and other attacks. You’ll typically work with your hosting provider or adjust server config files to implement these headers.
Work with Your Host or Security Tools
- Hosting Provider: Ask them to enable headers such as Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, Referrer-Policy, and X-Content-Type-Options.
- Security Services: Use platforms like Patchstack or plugins (e.g., BetterStudio Security) to toggle these headers without server-level edits.
- Beginner’s Guide: Refer to the WPBeginner article “How to Add HTTP Security Headers in WordPress” for step-by-step instructions.
Manual Configuration Examples
Apache (.htaccess)
<IfModule mod_headers.c>
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set Referrer-Policy "no-referrer-when-downgrade"
Header set Content-Security-Policy "default-src 'self';"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>
Nginx (server block)
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "no-referrer-when-downgrade";
add_header Content-Security-Policy "default-src 'self';";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
After saving, reload or restart your web server to apply the changes.
Helpful Links
1. Patchstack
2. How to Add HTTP Security Headers in WordPress (Beginner’s Guide)3. BetterStudio
Troubleshooting and FAQs
Q: My headers aren’t appearing—what should I check?
A: Clear any CDN or server caches, then inspect response headers via curl -I https://yourdomain.com or your browser’s Network tab.
Q: Enabling CSP broke my site—how can I fix it?
A: Begin with a permissive policy (e.g. default-src ‘self’ ‘unsafe-inline’), then tighten by whitelisting only the domains you need.
Q: How can I verify my configuration?
A: Use tools like securityheaders.com to scan and grade your headers.
Q: Who can help if I get stuck?
A: For server-level questions, contact your hosting provider or a system administrator. For BuddyBoss-specific concerns, submit a ticket via your BuddyBoss account dashboard.