Hardening Your WordPress Site: Implementing HTTP Security Headers via .htaccess

Security misconfiguration is one of the most common reasons websites are compromised. While many site owners focus on plugins, HTTP security headers are a critical, low-overhead method to add a foundational layer of protection directly from your web server. These headers are essentially instructions sent from your server to a visitor’s browser, telling it how to handle your site’s content and interact with it safely.

Why Use .htaccess for Security?

For sites running on Apache web servers, the .htaccess file is a powerful configuration tool that allows for decentralized management of server settings. By adding security rules here, you protect your site before the WordPress core even begins to load, reducing the strain on your server and catching potential threats early.

The Hardening Snippet

To implement these protections, access your site’s root directory via FTP or your hosting File Manager and paste the following code into your .htaccess file, ensuring it is placed outside of the default # BEGIN WordPress block to prevent it from being overwritten during updates:

# Security headers — place OUTSIDE the WordPress block
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

A Breakdown of Your Protections

• X-Frame-Options “SAMEORIGIN”: This header is your primary defense against clickjacking attacks, where an attacker hides your site inside an invisible frame to trick users into performing unauthorized actions. The SAMEORIGIN setting ensures your site can only be embedded in frames on your own domain.
• X-Content-Type-Options “nosniff”: This prevents MIME-type confusion attacks. It stops browsers from “guessing” the content type of a file, which ensures that a malicious script disguised as a harmless image file cannot be executed by the browser.
• X-XSS-Protection “1; mode=block”: This activates a browser’s built-in filter to detect and block reflective cross-site scripting (XSS) attacks. While modern browsers are moving toward more comprehensive solutions, this remains a helpful legacy protection.
• Referrer-Policy “strict-origin…”: This protects user privacy by controlling how much information is shared when a user clicks a link to leave your site. It ensures that sensitive path and query information aren’t leaked to external destinations.
• Strict-Transport-Security (HSTS): This forces the browser to always use secure HTTPS connections. It protects against protocol downgrade attacks and cookie hijacking by ensuring communication is never sent over an unencrypted HTTP connection.

Pro-Level Hardening: Adding a Content Security Policy (CSP)

To further enhance your defense, the sources strongly recommend adding a Content Security Policy (CSP). A CSP is the most powerful header available because it allows you to whitelist exactly which scripts, images, and fonts are allowed to load on your page, effectively neutralizing unauthorized code injections.

You can add a basic, restrictive CSP to the code block above to start:

DISCLAIMER: THIS LINE CAN INTERFERE WITH ADMIN PAGE. USE AS INDICATED:

SetEnvIf Request_URI “^/wp-admin” NO_CSP

    Header always set Content-Security-Policy “default-src ‘self’ ‘unsafe-inline’ https:;” env=!NO_CSP

Testing Your Implementation

Once you have saved your .htaccess file, it is vital to clear all server and plugin caches. You can verify that your headers are active by using your browser’s “Developer Tools” under the Network tab or by using free online tools like SecurityHeaders.com.

Note: Always back up your .htaccess file before making changes, as incorrect syntax can result in a 500 Internal Server Error.