---
title: Security headers
canonical: https://wpsecurityninja.com/dictionary/security-headers/
---
# Security headers

Security headers are HTTP response headers that tell browsers how to treat your pages for safer defaults.

Last updated: 2026-08-26

Also called: HTTP security headers, HSTS, X-Frame-Options

## Related terms

- [SSL/TLS](https://wpsecurityninja.com/dictionary/ssl-tls/): SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- [Security hardening](https://wpsecurityninja.com/dictionary/security-hardening/): Hardening is the set of configuration and process changes that make a site harder to abuse.
- [Cross-site scripting (XSS)](https://wpsecurityninja.com/dictionary/xss/): Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- [CSRF](https://wpsecurityninja.com/dictionary/csrf/): CSRF tricks a logged-in browser into sending a request the user did not mean to send.

[Full guide](https://wpsecurityninja.com/wordpress-security-hardening-guide/)

## Why it matters for WordPress

Headers will not patch a vulnerable plugin. They still reduce common browser-side risks: forcing HTTPS (HSTS), blocking easy clickjacking, tightening what scripts can run when you use CSP carefully. Many hosts and CDNs can send them without a plugin pile-on.

## How it shows up in practice

- `Strict-Transport-Security` on an HTTPS site
- `X-Frame-Options` or `frame-ancestors` limiting who can iframe you
- `Content-Security-Policy` that breaks a page builder if set too tight on day one
- Security test checklists that flag missing headers on production

## What to do

1. Finish HTTPS properly before turning on HSTS with a long max-age.
2. Start with simple framing protections, then consider CSP once you can test the front end.
3. Prefer host or CDN configuration when you can; fewer moving parts in WordPress.
4. Re-test checkout, embeds, and admin after any header change.
5. For step-by-step setup in WP Security Ninja, see [security headers in the plugin](https://wpsecurityninja.com/docs/security-fixes/security-headers/).