What are WordPress security headers?

Correctly configured security headers will add  to your wordpress website’s security. …

An HTTP security header typically renders additional information (for eample content meta, type, cache status….) from the serve

What is rendering in Web design?

In web development, rendering is the process by which website code is transformed into the interactive pages users see when they visit a website. As a general term, it refers to HTML, CSS, and JavaScript. An engine that renders a web page completes the process. The rendering engine is a software component of a web browser.

How do I add a security header in WordPress?

1. Find your .htaccess file in the root folder of your website
2. Open this file in edit mode
3. It should be opened in a plain text editor
4. Ädd this code (below) to the bottom of the file. This will enable HTTPS Security headers to your site.

This is the code to add

# Security header
Header always set Strict-Transport-Security: “max-age=31536000” env=HTTPS
Header always set Content-Security-Policy “upgrade-insecure-requests”
Header always set X-Content-Type-Options “nosniff”
Header always set X-XSS-Protection “1; mode=block”
Header always set Expect-CT “max-age=7776000, enforce”
Header always set Referrer-Policy: “no-referrer-when-downgrade”
Header always append X-Frame-Options SAMEORIGIN
# Security header

Remember to save your changes and check your website to make sure that everything is working.

Note: Incorrect headers or conflicts may cause 500 Internal server error on most web hosts

How to prevent WordPress from over-writing your .htaccess code

Normally WordPress only affects rules between

# BEGIN WordPress and

# END WordPress,

### custom rules

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

### custom rules

Useful resources

https://www.wpbeginner.com/beginners-guide/how-to-add-http-security-headers-in-wordpress/