{
    "title": "HTTP security headers",
    "seo_title": "HTTP security headers: definition and the ones you need",
    "h1": "HTTP security headers",
    "description": "HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy: the role of each HTTP security header, the ones to remove and where to set them on WordPress.",
    "lead": "HTTP security headers are instructions the server sends with every page and the browser enforces: forcing HTTPS, forbidding display in an external frame, limiting allowed scripts or the information passed along. They protect visitors without fixing vulnerabilities in the site itself.",
    "language": "en",
    "locale": "en-US",
    "type": "definition",
    "url": "https://www.wp-masquerade.com/glossary/http-security-headers/",
    "canonical": "https://www.wp-masquerade.com/glossary/http-security-headers/",
    "markdown": "https://www.wp-masquerade.com/glossary/http-security-headers/index.md",
    "json": "https://www.wp-masquerade.com/glossary/http-security-headers/index.json",
    "published": "2026-10-28T08:00:00+00:00",
    "modified": "2026-10-28T20:03:07+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "HTTP security headers",
            "url": "https://www.wp-masquerade.com/glossary/http-security-headers/",
            "markdown": "https://www.wp-masquerade.com/glossary/http-security-headers/index.md",
            "json": "https://www.wp-masquerade.com/glossary/http-security-headers/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "En-têtes de sécurité HTTP",
            "url": "https://www.wp-masquerade.com/fr/definitions/en-tetes-securite-http/",
            "markdown": "https://www.wp-masquerade.com/fr/definitions/en-tetes-securite-http/index.md",
            "json": "https://www.wp-masquerade.com/fr/definitions/en-tetes-securite-http/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Cabeceras de seguridad HTTP",
            "url": "https://www.wp-masquerade.com/es/glosario/cabeceras-de-seguridad-http/",
            "markdown": "https://www.wp-masquerade.com/es/glosario/cabeceras-de-seguridad-http/index.md",
            "json": "https://www.wp-masquerade.com/es/glosario/cabeceras-de-seguridad-http/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "HTTP-Sicherheitsheader",
            "url": "https://www.wp-masquerade.com/de/glossar/http-sicherheitsheader/",
            "markdown": "https://www.wp-masquerade.com/de/glossar/http-sicherheitsheader/index.md",
            "json": "https://www.wp-masquerade.com/de/glossar/http-sicherheitsheader/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Header di sicurezza HTTP",
            "url": "https://www.wp-masquerade.com/it/glossario/header-sicurezza-http/",
            "markdown": "https://www.wp-masquerade.com/it/glossario/header-sicurezza-http/index.md",
            "json": "https://www.wp-masquerade.com/it/glossario/header-sicurezza-http/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Cabeçalhos de segurança HTTP",
            "url": "https://www.wp-masquerade.com/pt/glossario/cabecalhos-de-seguranca-http/",
            "markdown": "https://www.wp-masquerade.com/pt/glossario/cabecalhos-de-seguranca-http/index.md",
            "json": "https://www.wp-masquerade.com/pt/glossario/cabecalhos-de-seguranca-http/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "HTTP-beveiligingsheaders",
            "url": "https://www.wp-masquerade.com/nl/woordenlijst/http-beveiligingsheaders/",
            "markdown": "https://www.wp-masquerade.com/nl/woordenlijst/http-beveiligingsheaders/index.md",
            "json": "https://www.wp-masquerade.com/nl/woordenlijst/http-beveiligingsheaders/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "HTTP security headers"
        },
        {
            "level": 2,
            "text": "The main security headers"
        },
        {
            "level": 2,
            "text": "Headers to stop sending"
        },
        {
            "level": 2,
            "text": "For WordPress"
        },
        {
            "level": 2,
            "text": "Common mistakes"
        }
    ],
    "body": "Every response from a web server starts with headers the visitor never sees: content type, caching, cookies. Some of them exist only for security. They don't fix any vulnerability on the site, but they ask the browser to refuse risky behavior: displaying the page inside another site's frame, guessing a file's type, loading an unknown script or falling back to HTTP. The protection therefore applies to visitors and to how your pages are rendered for them.\n\n## The main security headers\n\n| Header | Role | Typical value |\n| --- | --- | --- |\n| `Strict-Transport-Security` | Forces HTTPS on later visits | `max-age=31536000` |\n| `Content-Security-Policy` | Lists allowed sources of scripts, styles and frames | Built site by site |\n| `X-Frame-Options` | Forbids display in an external frame | `SAMEORIGIN` or `DENY` |\n| `X-Content-Type-Options` | Stops the browser from guessing a file's type | `nosniff` |\n| `Referrer-Policy` | Limits the URL passed to linked sites | `strict-origin-when-cross-origin` |\n| `Permissions-Policy` | Turns off sensitive browser APIs | `camera=(), microphone=(), geolocation=()` |\n\nTwo of them deserve their own definition: [HSTS](https://www.wp-masquerade.com/glossary/hsts/), which locks in HTTPS, and [Content Security Policy](https://www.wp-masquerade.com/glossary/content-security-policy/), the most effective header against [cross-site scripting (XSS)](https://www.wp-masquerade.com/glossary/xss/) but also the trickiest to configure. `X-Frame-Options` and the CSP `frame-ancestors` directive protect against [clickjacking](https://www.wp-masquerade.com/glossary/clickjacking/).\n\n![Three-column table: headers with a low risk of breakage (nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy), headers to test first (HSTS and CSP, in report-only mode then in steps), headers to stop sending (X-XSS-Protection, Expect-CT, Feature-Policy, X-Powered-By)](https://www.wp-masquerade.com/media/2026/10/en-tetes-securite-carte-en.webp)\n\n*Useful headers, those that need a testing phase and those to remove.*\n\n## Headers to stop sending\n\nThe OWASP HTTP Headers Cheat Sheet advises against `X-XSS-Protection`, which can create vulnerabilities on otherwise safe sites (omit it or set it to `0`), and `Expect-CT`, which should be removed. `Feature-Policy` has been replaced by `Permissions-Policy`. Conversely, OWASP recommends removing `X-Powered-By` and making `Server` less talkative: these headers announce the PHP or server version and make [fingerprinting](https://www.wp-masquerade.com/glossary/fingerprinting/) easier.\n\n*Video: “HTTP Security Headers Explained - What are security headers and how do I implement them?” (Halo Security)*\n\n## For WordPress\n\nWordPress already sends `X-Frame-Options: SAMEORIGIN` and `frame-ancestors 'self'` on the admin area and the login page, through the `send_frame_options_header()` function. Public pages, however, get none of these headers by default. There are three places to add them:\n\n- **The server**: `Header always set` in an Apache or LiteSpeed `.htaccess` file, `add_header … always` in Nginx. This is the most complete solution, because it also covers static files and cached pages.\n- **The CDN**: response transform rules, handy if the site sits behind a proxy.\n- **PHP or a plugin**: the `send_headers` action, useful without access to the configuration, but missing from responses that don't go through WordPress.\n\nThen check the result with `curl -I https://your-site.com/` or the browser's Network tab, after clearing caches. Our guide to [HTTP security headers for WordPress](https://www.wp-masquerade.com/http-security-headers-wordpress/) gives starting values and configuration examples; the article [on what Google takes into account](https://www.wp-masquerade.com/https-security-headers-seo-trust/) covers their (small) role in SEO.\n\n## Common mistakes\n\n- Adding a header in two places (server and plugin) with different values.\n- Forgetting `always`: without it, Apache and Nginx don't add the header to error pages.\n- Chasing a perfect grade on an audit tool by enabling a strict CSP that breaks the editor or checkout.\n\nIn WP Masquerade, the free version sends `nosniff` from the first level of the Hardening module, and the Pro version manages [security headers](https://www.wp-masquerade.com/features/security-headers/) from the admin area, with a button that shows the headers actually received. A page served by an upstream cache may not carry them, though: the server configuration remains the safest place for a strict policy.\n\n## Related terms\n\n- [Content Security Policy (CSP)](https://www.wp-masquerade.com/glossary/content-security-policy/)\n- [HSTS](https://www.wp-masquerade.com/glossary/hsts/)\n- [Clickjacking](https://www.wp-masquerade.com/glossary/clickjacking/)\n- [XSS (cross-site scripting)](https://www.wp-masquerade.com/glossary/xss/)\n- [Fingerprinting](https://www.wp-masquerade.com/glossary/fingerprinting/)\n\n\n## Sources\n\n- [OWASP : HTTP Security Response Headers Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)\n- [MDN : Strict-Transport-Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security)\n- [WordPress Developer Resources : send_frame_options_header()](https://developer.wordpress.org/reference/functions/send_frame_options_header/)",
    "definition": "HTTP security headers are instructions the server sends with every page and the browser enforces: forcing HTTPS, forbidding display in an external frame, limiting allowed scripts or the information passed along. They protect visitors without fixing vulnerabilities in the site itself.",
    "group": "Web security",
    "aka": [
        "security headers",
        "HTTP response headers",
        "secure headers"
    ],
    "related": [
        {
            "title": "Content Security Policy (CSP)",
            "url": "https://www.wp-masquerade.com/glossary/content-security-policy/",
            "markdown": "https://www.wp-masquerade.com/glossary/content-security-policy/index.md"
        },
        {
            "title": "HSTS",
            "url": "https://www.wp-masquerade.com/glossary/hsts/",
            "markdown": "https://www.wp-masquerade.com/glossary/hsts/index.md"
        },
        {
            "title": "Clickjacking",
            "url": "https://www.wp-masquerade.com/glossary/clickjacking/",
            "markdown": "https://www.wp-masquerade.com/glossary/clickjacking/index.md"
        },
        {
            "title": "XSS (cross-site scripting)",
            "url": "https://www.wp-masquerade.com/glossary/xss/",
            "markdown": "https://www.wp-masquerade.com/glossary/xss/index.md"
        },
        {
            "title": "Fingerprinting",
            "url": "https://www.wp-masquerade.com/glossary/fingerprinting/",
            "markdown": "https://www.wp-masquerade.com/glossary/fingerprinting/index.md"
        }
    ],
    "sources": [
        {
            "title": "OWASP : HTTP Security Response Headers Cheat Sheet",
            "url": "https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html"
        },
        {
            "title": "MDN : Strict-Transport-Security",
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security"
        },
        {
            "title": "WordPress Developer Resources : send_frame_options_header()",
            "url": "https://developer.wordpress.org/reference/functions/send_frame_options_header/"
        }
    ],
    "format": "application/json"
}