Security Headers

No site is safe. A determined hacker will break in and do things you don’t want them to do. But you can make things more difficult for them. Securing the server and installing a plugin like WordFence is a good place to start.

You can then make sure the themes and plugins you install are from a trusted source.

And then look at your security headers. If you score A or A+ it’s all good. Anything else and the fix is pretty simple. Using whatever tools you prefer open up your .htaccess file and add this code to the top of the file:

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=(), interest-cohort=()"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; worker-src blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data: https://s0.wp.com; connect-src 'self'; frame-src 'self' blob:; frame-ancestors 'self';"
</IfModule>

This will give you an A. To get and A+ you need to remove the ‘unsafe-inline’ and ‘unsafe-eval’. But if you remove these WordPress stops working…