Skip to content

Headers

Core security headers

Every planAbout Security Headers

Sends a set of standard instructions with every page, telling browsers not to show your site inside other sites, not to guess file types, and how much to reveal when visitors follow a link away.

What it does

A header is a short line of text your server sends before each page. Visitors never see it, but their browser follows it.

X-Frame-Options stops other sites from showing your pages inside a frame, a trick called clickjacking where people are fooled into clicking your buttons.

X-Content-Type-Options tells the browser to trust the file type your server states, so an uploaded file cannot pretend to be a script.

Referrer-Policy controls how much of your page address is passed on when a visitor clicks a link to another site.

Permissions-Policy (optional) tells the browser your pages never use the camera, microphone, location, payment, USB or motion sensors, so nothing injected into a page can ask for them.

Why it matters

These headers cost nothing in speed and close whole families of browser attacks. Security scanners, insurers and audits often check for them first.

Set it up

  1. Go to the Headers tab, section Core headers, and switch on HTTP Security Headers.
  2. Leave X-Frame-Options on SAMEORIGIN unless another site of yours must show your pages in a frame.
  3. Leave Referrer-Policy on strict-origin-when-cross-origin, the modern default.
  4. Switch on Restrict browser features (Permissions-Policy) unless your site uses the camera, microphone, location or browser payments.
  5. Click Save Changes, then use the scan link in the Response headers panel to check the result from outside.

Good to know

This switch is also the master switch for Content Security Policy, HSTS and the cross-origin headers: they are only sent while it is on.

Your host, a CDN or another plugin may send some of the same headers. Two copies of a header can confuse browsers, so if a scan shows duplicates, switch them off in one place.

The Response headers panel shows what Stack Guard sends from your saved settings, not what finally reaches the browser after your host.

Which plan includes it

Core headers are in every plan.

How it works, for developers
  • Headers are sent with PHP header() on the send_headers action (priority 10), which WordPress fires for front-end pages. The admin area, the sign-in page, AJAX and REST responses do not pass through it.
  • Always sent while on: X-Content-Type-Options: nosniff and X-XSS-Protection: 1; mode=block (kept for older browsers; modern browsers ignore it).
  • Permissions-Policy value: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=().
  • Settings: smg_security_headers, smg_x_frame_options (default SAMEORIGIN), smg_referrer_policy, smg_permissions_policy. The list in the side panel comes from SMG_Headers::get_response_headers(), the same function that sends them.

Quick answers about core security headers

What does Core security headers do in Stack Guard?

A header is a short line of text your server sends before each page. Visitors never see it, but their browser follows it. X-Frame-Options stops other sites from showing your pages inside a frame, a trick called clickjacking where people are fooled into clicking your buttons. X-Content-Type-Options tells the browser to trust the file type your server states, so an uploaded file cannot pretend to be a script. Referrer-Policy controls how much of your page address is passed on when a visitor clicks a link to another site. Permissions-Policy (optional) tells the browser your pages never use the camera, microphone, location, payment, USB or motion sensors, so nothing injected into a page can ask for them.

Why use core security headers on a WordPress site?

These headers cost nothing in speed and close whole families of browser attacks. Security scanners, insurers and audits often check for them first.

How do I set up core security headers?

1. Go to the Headers tab, section Core headers, and switch on HTTP Security Headers. 2. Leave X-Frame-Options on SAMEORIGIN unless another site of yours must show your pages in a frame. 3. Leave Referrer-Policy on strict-origin-when-cross-origin, the modern default. 4. Switch on Restrict browser features (Permissions-Policy) unless your site uses the camera, microphone, location or browser payments. 5. Click Save Changes, then use the scan link in the Response headers panel to check the result from outside.

Which Stack Guard plan includes core security headers?

Core headers are in every plan.

More in Headers

Not running Stack Guard yet? It is free.

Download Free