<div dir="ltr"><div dir="ltr"><div dir="ltr" class="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><a href="https://www.tripwire.com/state-of-security/risk-based-security-for-executives/risk-management/how-add-http-security-headers-wordpress/">https://www.tripwire.com/state-of-security/risk-based-security-for-executives/risk-management/how-add-http-security-headers-wordpress/</a></div><div dir="ltr"><br></div><div dir="ltr">If you own a WordPress site, then you should be careful about your <a href="https://www.tripwire.com/state-of-security/featured/startup-website-security-and-wordpress-vulnerability/" target="_blank" rel="noopener">website security</a>. To successfully run a blog, business or online store, you need to make sure your website is totally safe.<br></div><div dir="ltr"><span class="entry-content gmail-post-content">
<p>Customers visit your website, purchase products and pass sensitive
information like passwords, credit card details etc. If there is a place
to infiltrate to your website, then hackers can steal your customers’
data.</p>
<p>When it comes to website security, then there are many things you can do to <a href="https://www.wpmyweb.com/wordpress/wordpress-security.html" target="_blank" rel="noopener">harden your WordPress security</a>.</p>
<p>However, a great place to improve your website security is to add
HTTP security headers in your WordPress site which makes sure you are
staying up to date with the finest security practices.</p>
<p>HTTP security headers add another layer of security by helping to alleviate attacks and security vulnerabilities.</p>
<p>In this article, we will discuss what HTTP response headers are and how to add HTTP security headers in WordPress.</p>
<h2>What are HTTP Security Headers?</h2>
<p>When a user visits a website through a web browser, the server reacts
with HTTP Response Headers. These headers inform the web browser how to
act throughout its interaction with the website. These headers
generally consist of metadata such as cache control, status error codes,
content-encoding, etc.</p>
<p>By utilizing HTTP response headers, you can harden your website security and also prevent/mitigate attacks.</p>
<p>For example, by adding the <b>strict-transport-security</b>, you can
force all the latest web browsers like Google Chrome, Firefox and Safari
to communicate with your website over HTTPS only.</p>
<p>Let’s have a look at 6 HTTP security headers,</p>
<ul>
<li>HTTP Strict Transport Security (HSTS)</li>
<li>X-Frame-Options</li>
<li>X-XSS-Protection</li>
<li>X-Content-Type-Options</li>
<li>Referrer-Policy</li>
<li>Feature-Policy</li>
</ul>
<h4>HTTP Strict Transport Security (HSTS)</h4>
<p>Let’s say you have a site <a href="http://example.com">example.com</a>, and you <a href="https://www.tripwire.com/state-of-security/risk-based-security-for-executives/connecting-security-to-the-business/lets-encrypt-a-certificate-authority-to-help-the-entire-web-deploy-https/" target="_blank" rel="noopener">set up an SSL/TLS certificate</a> to move from HTTP to HTTPS.</p>
<p>Now you know that your website is accessible with HTTPS only.</p>
<p>What if I tell you that your website is still accessible over HTTP?
Yes, you heard it right. There are several scripts available that
hackers use to open a website over HTTP.</p>
<p>By utilizing the <b>strict-transport-security</b>, you can force all
the latest web browsers like Google Chrome, Firefox and Safari to
communicate with your website over HTTPS only. So if an attacker tries
to open your WordPress site over HTTP, the web browser wouldn’t load the
page.</p>
<h4>X-XSS Protection</h4>
<p>X-XSS, also known as cross-site scripting, is a security header that protects sites against cross-site scripting.</p>
<p>By default, this security header is built in and enabled into modern
web browsers. Implementing it will force your browser to load it. This
security header wouldn’t let a page load if it detects a cross-site
scripting attack.</p>
<h4>X-Content-Type-Options</h4>
<p>The X-Content-Type-Options is a kind of security header with the
value of nosniff that prevents Google Chrome, Internet Explorer and
Firefox from MIME-Sniffing a response away from the declared content
type.</p>
<p>This security header protects the content and reduces the risk of drive-by downloads.</p>
<h4>X-Frame Options</h4>
<p>The x-frame-options header protects sites against clickjacking by not
enabling iframes to fill on your website. It is supported by IE 8+,
Chrome 4.1+, Firefox 3.6.9+, Opera 10.5+ and Safari 4+.</p>
<p>In this method, an attacker fools a user into clicking something that
isn’t there. A user may believe that he/she is on the main site;
however, something else is running in the background. This way, hackers
can steal information from your web browser.</p>
<h4>Referrer-Policy</h4>
<p>When a user visits a website, immediately a “Referrer” header is
included that informs the server where the visitor is originating from.
This header is utilized for analytical functions.</p>
<p>As you comprehend, this presents a personal privacy issue. This can
be prevented by adding Referrer-Policy to your WordPress site.</p>
<h4>Feature-Policy</h4>
<p>Feature Policy is a kind of security header that allows website
owners to allow and disallow specific web platform functions on their
own pages and those they embed.</p>
<p>Utilizing the Feature-Policy header, you as a site owner can restrict the web browser functions for a site.</p>
<p>For every single function, you must specify what’s allowed and what’s not. Here are the Feature Policies:</p>
<ul>
<li>geolocation</li>
<li>midi</li>
<li>notifications</li>
<li>push</li>
<li>sync-xhr</li>
<li>microphone</li>
<li>camera</li>
<li>magnetometer</li>
<li>gyroscope</li>
<li>speaker</li>
<li>vibrate</li>
<li>fullscreen</li>
<li>payment</li>
</ul>
<p>For example, if you want to disable <b>geolocation</b> and <b>camera</b> in your WordPress site, you need to define a feature policy this way:</p>
<pre>Feature-Policy: geolocation ‘none’ ; camera ‘none’</pre>
<p>By specifying the <b>‘none’</b> word for the origin list, the specific feature(s) will be disabled for all browsers contexts.</p>
<p><b>Note:</b></p>
<ul>
<li>Before you add HTTP security headers in your WordPress site, make
sure you have an SSL certificate installed or else your site wouldn’t be
accessible.</li>
<li>Before you edit any of your files, make sure to take a full backup.</li>
</ul>
<h2>How to Add HTTP Response Headers in WordPress</h2>
<p>To add HTTP response headers in WordPress, you just need to add the following lines into your <b>.htaccess</b> file.</p>
<p>First, log in to your <a href="https://www.wpmyweb.com/hosting/best-wordpress-hosting.html" target="_blank" rel="noopener">WordPress hosting</a> cPanel account and from there go to the root folder of your WordPress site. Then, find the <b>.htaccess</b> file and edit it.</p>
<p>As it is a (.) file, it can be hidden. If you can’t find the <b>.htaccess</b> file inside the root folder, go to settings and click on “<b>show hidden files</b>”.</p>
<p>Now add the following piece of lines at the end:</p>
<pre>Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options nosniff
Header always append X-Frame-Options SAMEORIGIN
Header Referrer-Policy: no-referrer-when-downgrade</pre>
<p>Once added, <b>save</b> the file.</p>
<p>Now, go to <a href="https://securityheaders.com/" target="_blank" rel="noopener">securityheaders.com</a> to check whether the code is working or not.</p>
<p><img src="https://3b6xlt3iddqmuq5vy2w0s5d3-wpengine.netdna-ssl.com/state-of-security/wp-content/uploads/sites/3/security-report-summary.jpg" class="gmail-alignnone gmail-size-full gmail-wp-image-51865" alt="security report summary" style="display: inline;"></p>
<p><b>Note:</b> We haven’t added the Feature Policy and Content Security
Policy because they are more complicated to set up and may break your
site. But these are enough to harden your WordPress security.</p>
<p>That’s it. We hope this tutorial helped you to understand the basics
of HTTP security header and how to implement them on your WordPress
site. If you have any questions regarding this article, do let us know
in the comment section.</p></span><br clear="all"><div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><b><span style="font-size:10pt"></span></b><span style="font-size:10pt"></span><span style="font-family:arial,helvetica,sans-serif"></span><br><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>