Hardening Dictionary
Security headers
Definition
Security headers are HTTP response headers that tell browsers how to treat your pages for safer defaults.
Also called: HTTP security headers, HSTS, X-Frame-Options
Why it matters for WordPress
Headers will not patch a vulnerable plugin. They still reduce common browser-side risks: forcing HTTPS (HSTS), blocking easy clickjacking, tightening what scripts can run when you use CSP carefully. Many hosts and CDNs can send them without a plugin pile-on.
How it shows up in practice
Strict-Transport-Securityon an HTTPS siteX-Frame-Optionsorframe-ancestorslimiting who can iframe youContent-Security-Policythat breaks a page builder if set too tight on day one- Security test checklists that flag missing headers on production
What to do
- Finish HTTPS properly before turning on HSTS with a long max-age.
- Start with simple framing protections, then consider CSP once you can test the front end.
- Prefer host or CDN configuration when you can; fewer moving parts in WordPress.
- Re-test checkout, embeds, and admin after any header change.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- SSL/TLS SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- CSRF CSRF tricks a logged-in browser into sending a request the user did not mean to send.