How urgent is this? HTTP security headers are medium-low priority. Missing headers leave the site more vulnerable to attacks like clickjacking and cross-site scripting (XSS), but they do not directly expose user data. They are quick wins and good practice, especially for sites handling donations or financial transactions.
Who does this?
The person responsible for the organisation's WordPress website. This does not require server-level access — all headers can be set via a WordPress plugin or the .htaccess file.
Background: what do security headers do?
Header
What it does
Strict-Transport-Security
Forces browsers to always use HTTPS, even if someone types http://
Content-Security-Policy
Prevents the browser from loading malicious scripts or assets
X-Content-Type-Options
Prevents browsers from guessing file types, reducing injection risks
Referrer-Policy
Controls how much referrer information is sent when navigating away from your site
Permissions-Policy
Controls which browser features (camera, microphone, geolocation) the site can use
Step 1: Install a security headers plugin
Install one of the following WordPress plugins — they allow you to add security headers without touching server configuration:
HTTP Headers by Fer Perez — most focused option, maps directly to the headers listed above
Solid Security (formerly iThemes Security) — broader security plugin with header support
Rank Math SEO — if already installed, has security headers built in
The most focused option is HTTP Headers by Fer Perez.
Step 2: Add the headers
After installing the plugin, add the following headers one by one:
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy
geolocation=(), microphone=(), camera=()
Skip Content-Security-Policy (CSP) for now. CSP is the most complex header and requires careful tuning per site. A wrong value can break the site — blocking legitimate scripts, fonts, or payment widgets. Tackle this separately once the other headers are in place.
Step 3: Verify
Re-run the scan at securityheaders.com. The four headers should now show green and the overall grade should improve to at least B.
If any header is still missing, double-check that the plugin is active and that there is no caching layer (e.g. Cloudflare, WP Rocket) serving a cached version of the page without the new headers. Clear all caches and re-test.