# Send Basic Security Headers

> Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, headers, hardening
- Author: WPIDE Team
- Installs: 6
- Updated: 2026-10-28
- Page: https://wpide.com/library/security-headers/

## Code

```php
add_action( 'send_headers', function () {
    if ( headers_sent() ) {
        return;
    }

    header( 'X-Content-Type-Options: nosniff' );
    header( 'X-Frame-Options: SAMEORIGIN' );
    header( 'Referrer-Policy: strict-origin-when-cross-origin' );
    header( 'Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()' );
    header_remove( 'X-Powered-By' );
} );
```

## Notes

If you embed your own pages in iframes on another domain, remove the X-Frame-Options line. Headers set by your server or CDN may override these.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Send Basic Security Headers" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/