Security Headers for wp-admin and the Login Page
Sends nosniff, a strict referrer policy, a restrictive permissions policy and a cross-origin opener policy on dashboard and login pages, which front-end header snippets do not cover.
Opens WPIDE on
Code
$wpide_admin_headers = function () {
if ( headers_sent() ) {
return;
}
header( 'X-Content-Type-Options: nosniff' );
header( 'Referrer-Policy: same-origin' );
header( 'Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()' );
header( 'Cross-Origin-Opener-Policy: same-origin-allow-popups' );
};
add_action( 'admin_init', $wpide_admin_headers, 1 );
add_action( 'login_init', $wpide_admin_headers, 1 );Notes
WordPress already sends X-Frame-Options on these screens; this adds the remaining common headers.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.