# Security Headers for wp-admin and the Login Page

> Sends nosniff, a strict referrer policy, a restrictive permissions policy and a cross-origin opener policy on dashboard and login pages, which front-end header snippets do not cover.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: headers, admin, login
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-admin-login-headers/

## Code

```php
$wpide_admin_headers = function () {
    if ( headers_sent() ) {
        return;
    }

    header( 'X-Content-Type-Options: nosniff' );
    header( 'Referrer-Policy: same-origin' );
    header( 'Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()' );
    header( 'Cross-Origin-Opener-Policy: same-origin-allow-popups' );
};

add_action( 'admin_init', $wpide_admin_headers, 1 );
add_action( 'login_init', $wpide_admin_headers, 1 );
```

## Notes

WordPress already sends X-Frame-Options on these screens; this adds the remaining common headers.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Security Headers for wp-admin and the Login Page" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/