Send Basic Security Headers
Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.
Opens WPIDE on
Code
add_action( 'send_headers', function () {
if ( headers_sent() ) {
return;
}
header( 'X-Content-Type-Options: nosniff' );
header( 'X-Frame-Options: SAMEORIGIN' );
header( 'Referrer-Policy: strict-origin-when-cross-origin' );
header( 'Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()' );
header_remove( 'X-Powered-By' );
} );Notes
If you embed your own pages in iframes on another domain, remove the X-Frame-Options line. Headers set by your server or CDN may override these.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.